Guest access in Microsoft Entra ID is governed by two sets of settings that are easy to mix up: external collaboration settings and cross-tenant access settings. Get the split wrong and you either block a partner you meant to allow, or make every guest register MFA again in your tenant. In this deep dive I'll explain what each layer controls, how default and organizational settings interact, how to trust partner MFA and devices, and how B2B direct connect powers Teams shared channels.
How it works: two layers#
| External collaboration settings | Cross-tenant access settings | |
|---|---|---|
| Applies to | All guests, including Microsoft accounts, email one-time passcode and social identities | Other Microsoft Entra organizations only |
| Controls | What guests can see in your directory, who can invite, self-service sign-up, domain allow or deny lists, whether external users can leave | Inbound and outbound B2B collaboration and B2B direct connect, trust for MFA and device claims, automatic redemption, cross-tenant sync |
| Location | Entra ID › External Identities › External collaboration settings | Entra ID › External Identities › Cross-tenant access settings |
| Typical role | Global Administrator or External Identity Provider Administrator | Security Administrator |
Both layers are checked when someone sends an invitation. A domain on the deny list can't be invited whatever the cross-tenant settings say; a domain on the allow list can be invited unless cross-tenant settings explicitly block it; anything on neither list falls through to cross-tenant access settings.
Default versus organizational settings#
Default settings apply to every Microsoft Entra tenant you haven't added explicitly. Out of the box, B2B collaboration is allowed in both directions, MFA and device claims from other tenants aren't trusted, B2B direct connect is blocked inbound and outbound, and no organizations are listed. When you add a tenant under Organizational settings, it starts as Inherited from default; anything you customise overrides the defaults for that tenant only.
Each direction has two halves: users and groups, and applications. Scoping to specific users, groups or apps, and configuring trust settings, requires Microsoft Entra ID P1 in the tenant you configure; B2B direct connect needs P1 in both tenants.
Step-by-step#
1. Set sensible external collaboration settings#
- Guest user access: the default limits guests' view of directory objects; Guest user access is restricted to properties and memberships of their own directory objects is the most restrictive option and worth considering.
- Guest invite settings: if anyone can invite today, move to Member users and users assigned to specific admin roles, or to Only users assigned to specific admin roles and grant the Guest Inviter role to the people who need it.
- Collaboration restrictions: use a deny list for domains you never want, or an allow list if you work with a fixed set of partners.
2. Discover existing traffic before changing defaults#
Blocking a default can cut off collaboration nobody told you about. If sign-in logs flow to Log Analytics, see who crosses your tenant boundary today:
SigninLogs
| where TimeGenerated > ago(30d)
| where isnotempty(CrossTenantAccessType) and CrossTenantAccessType != "none"
| summarize SignIns = count(), Users = dcount(UserPrincipalName)
by CrossTenantAccessType, HomeTenantName, HomeTenantId, ResourceTenantId
| sort by SignIns descA partner's ID in HomeTenantId means inbound guests; in ResourceTenantId it means your users going out. Microsoft also provides a Cross-tenant access activity workbook for the same purpose.
3. Add partner organizations#
In Cross-tenant access settings › Organizational settings, select Add organization and enter the partner's domain or tenant ID. Open the Inherited from default link under Inbound access or Outbound access, choose Customize settings and set which users, groups and applications are allowed. Targeting partner groups needs their object IDs from the partner's admin. If you allow-list applications, include My Apps, My Profile, My Sign-ins and Microsoft App Access Panel, or guests can't reach their landing page or register MFA; some can only be added through Microsoft Graph.
4. Trust MFA and device claims from partners you know#
On the partner's Inbound access › Trust settings tab you can select Trust multifactor authentication from Microsoft Entra tenants, Trust compliant devices and Trust Microsoft Entra hybrid joined devices. Your Conditional Access policies still apply to those guests, but a requirement already satisfied in their home tenant is accepted instead of being challenged again; if MFA hasn't been done, the challenge happens at home. Without MFA trust, guests register and perform MFA in your tenant, and because you don't manage their devices, a compliant-device requirement realistically depends on trusted claims. Enable trust per partner rather than in the defaults, which cover every tenant. The same tab offers Automatically redeem invitations, which only suppresses the consent prompt when both tenants tick it. For guest MFA policies, see a Conditional Access baseline.
5. Enable B2B direct connect for Teams shared channels#
B2B direct connect currently works with Teams shared channels: partner users join with their home credentials and no guest object is created in your directory. It needs mutual consent:
- In the partner's organizational settings, allow inbound and outbound B2B direct connect, scoped to groups if needed.
- The partner configures the same for your tenant; until both sides allow it, sharing doesn't work.
- If your Conditional Access requires MFA for external users, trust MFA from that partner, otherwise direct connect users are blocked.
- Make sure the Teams shared channel policies in the Teams admin center allow external participants.
Channel owners can then add partner users by their full email address. B2B direct connect isn't supported between different Microsoft clouds.
Verify#
Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgPolicyCrossTenantAccessPolicyPartner -All |
Select-Object TenantId,
@{ n = 'TrustMfa'; e = { $_.InboundTrust.IsMfaAccepted } },
@{ n = 'TrustCompliant'; e = { $_.InboundTrust.IsCompliantDeviceAccepted } },
@{ n = 'TrustHybrid'; e = { $_.InboundTrust.IsHybridAzureADJoinedDeviceAccepted } }- Each partner should show exactly the trust you agreed.
- In Entra ID › Monitoring & health › Sign-in logs, filter on Cross tenant access type (B2B collaboration or B2B direct connect) and check that partner sign-ins satisfy your Conditional Access policies without guests registering MFA in your tenant.
- In the audit logs, filter on the
CrossTenantAccessSettingscategory to see every change and who made it.
Tips & gotchas#
- Trust and ID Protection. If you trust partner MFA, consider excluding external users from the ID Protection MFA registration policy; with both in place, guests can't satisfy access requirements.
- SharePoint and OneDrive. With SharePoint and OneDrive B2B integration, also add partner domains to the external collaboration settings; adding the tenant in cross-tenant access settings alone may not let those invitations through.
- Tenant restrictions are separate. They control which external accounts your users can use on your devices and aren't affected by inbound or outbound settings.
- Protect the settings. Changes to cross-tenant access settings are protected actions, so you can require stronger authentication for them through Conditional Access.
- Clean up guests. Settings don't remove old guests; schedule access reviews for them.
