- User account is visible on the users list and has a security role, however user can't authenticate.
- You can't assign a security role to a specific user on a specific tenant.
- User can't connect via Outlook client, with organizationId error.
- User can't run reports (not a member of ReportingGroup).
As you can see above the Organization database links to the SystemUserOrganizations, so this means on the MSCRM_CONFIG you should have one entry for each tenant the user is member of. The diagram can help you to quickly identify User and Tenant relationships.
Note: for the situation where the user can't run reports, just add the user to the ReportingGroup.
Hope this was useful :)