Microsoft's edit · Cross-tenant access settings

44

55 ms.service: entra-external-id

66 ms.topic: overview

7 −ms.date: 06/20/2024

7 +ms.date: 08/20/2024

88

99 ms.author: cmulligan

1010 author: csmulligan

1919

2020 [!INCLUDE [applies-to-workforce-only](./includes/applies-to-workforce-only.md)]

2121

22 −Microsoft Entra organizations can use External ID cross-tenant access settings to manage how they collaborate with other Microsoft Entra organizations and other Microsoft Azure clouds through B2B collaboration and [B2B direct connect](cross-tenant-access-settings-b2b-direct-connect.md). [Cross-tenant access settings](cross-tenant-access-settings-b2b-collaboration.yml) give you granular control over collaboration with external Microsoft Entra organizations. They govern inbound access, which is how others collaborate with you, and outbound access, which is how your users collaborate with external Microsoft Entra organizations. Additionally, these settings allow you to trust multifactor authentication (MFA) and device claims, including [compliant claims and Microsoft Entra hybrid joined claims](~/identity/conditional-access/howto-conditional-access-policy-compliant-device.md), from other Microsoft Entra organizations.

22 +Microsoft Entra organizations can use External ID cross-tenant access settings to manage collaboration with other Microsoft Entra organizations and Microsoft Azure clouds through B2B collaboration and [B2B direct connect](cross-tenant-access-settings-b2b-direct-connect.md). The [cross-tenant access settings](cross-tenant-access-settings-b2b-collaboration.yml) provide granular control over inbound and outbound access, allowing you to trust multifactor authentication (MFA) and device claims from other organizations.

2323

24 −This article describes cross-tenant access settings, which are used to manage B2B collaboration and B2B direct connect with external Microsoft Entra organizations, including across Microsoft clouds. More settings are available for B2B collaboration with non-Microsoft Entra identities (for example, social identities or non-IT managed external accounts). These [external collaboration settings](external-collaboration-settings-configure.md) include options for restricting guest user access, specifying who can invite guests, and allowing or blocking domains.

24 +This article covers cross-tenant access settings for managing B2B collaboration and B2B direct connect with external Entra organizations, including across Microsoft clouds. Other settings are available for B2B collaboration with non-Microsoft Entra identities (for example, social identities or non-IT managed external accounts). These [external collaboration settings](external-collaboration-settings-configure.md) include options for restricting guest user access, specifying who can invite guests, and allowing or blocking domains.

2525

2626 > [!IMPORTANT]

2727 > Microsoft started to move customers using cross-tenant access settings to a new storage model on August 30, 2023. You may notice an entry in your audit logs informing you that your cross-tenant access settings were updated as our automated task migrates your settings. For a brief window while the migration processes, you'll be unable to make changes to your settings. If you're unable to make a change, wait a few moments and try the change again. Once the migration completes, [you'll no longer be capped with 25kb of storage space](./faq.yml#how-many-organizations-can-i-add-in-cross-tenant-access-settings-) and there will be no more limits on the number of partners you can add.

140140 Tenant restrictions are independent of other cross-tenant access settings, so any inbound, outbound, or trust settings you configure don't affect tenant restrictions. For details about configuring tenant restrictions, see [Set up tenant restrictions V2](tenant-restrictions-v2.md).

141141

142142 ## Microsoft cloud settings

143 +

143144

144145 Microsoft cloud settings let you collaborate with organizations from different Microsoft Azure clouds. With Microsoft cloud settings, you can establish mutual B2B collaboration between the following clouds:

145146

146 −- Microsoft Azure commercial cloud and Microsoft Azure Government

147 +- Microsoft Azure commercial cloud and Microsoft Azure Government, which includes the Office GCC-High and DoD clouds

147148 - Microsoft Azure commercial cloud and Microsoft Azure operated by 21Vianet (operated by 21Vianet)

148149

149150 > [!NOTE]

150 −> Microsoft Azure Government includes the Office GCC-High and DoD clouds.

151 −

152 −To set up B2B collaboration, both organizations configure their Microsoft cloud settings to enable the partner's cloud. Then each organization uses the partner's tenant ID to find and add the partner to their organizational settings. From there, each organization can allow their default cross-tenant access settings apply to the partner, or they can configure partner-specific inbound and outbound settings. After you establish B2B collaboration with a partner in another cloud, you'll be able to:

153 −

154 −- Use B2B collaboration to invite a user in the partner tenant to access resources in your organization, including web line-of-business apps, SaaS apps, and SharePoint Online sites, documents, and files.

155 −- Use B2B collaboration to [share Power BI content to a user in the partner tenant](/power-bi/enterprise/service-admin-azure-ad-b2b#cross-cloud-b2b).

156 −- Apply Conditional Access policies to the B2B collaboration user and opt to trust multifactor authentication or device claims (compliant claims and Microsoft Entra hybrid joined claims) from the user’s home tenant.

157 −

158 −> [!NOTE]

159151 > B2B direct connect is not supported for collaboration with Microsoft Entra tenants in a different Microsoft cloud.

160152

161 −For configuration steps, see [Configure Microsoft cloud settings for B2B collaboration](cross-cloud-settings.md).

153 +For more information, see [Configure Microsoft cloud settings for B2B collaboration](cross-cloud-settings.md).

162154

163155 ### Default settings in cross-cloud scenarios

164156

191183 - If you block access to all apps by default, users are unable to read emails encrypted with Microsoft Rights Management Service, also known as Office 365 Message Encryption (OME). To avoid this issue, we recommend configuring your outbound settings to allow your users to access this app ID: 00000012-0000-0000-c000-000000000000. If you allow only this application, access to all other apps is blocked by default.

192184

193185 ## Custom roles for managing cross-tenant access settings

194 −

195 −Your organization can [define custom roles](~/identity/role-based-access-control/custom-create.yml) to manage cross-tenant access settings. These roles allow for precise control without relying on built-in management roles.

196 −

197 −### Recommended custom roles

198 −

199 −#### Cross-tenant access administrator

200 −

201 −This role can manage everything in cross-tenant access settings, including default and organizational based settings. This role should be assigned to users who need to manage all settings in cross-tenant access settings.

202 −

203 −The following actions are recommended for this role.

204 −

205 −| Actions |

206 −| ------- |

207 −| microsoft.directory.tenantRelationships/standard/read |

208 −| microsoft.directory/crossTenantAccessPolicy/standard/read |

209 −| microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update |

210 −| microsoft.directory/crossTenantAccessPolicy/basic/update |

211 −| microsoft.directory/crossTenantAccessPolicy/default/b2bCollaboration/update |

212 −| microsoft.directory/crossTenantAccessPolicy/default/b2bDirectConnect/update |

213 −| microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update |

214 −| microsoft.directory/crossTenantAccessPolicy/default/standard/read |

215 −| microsoft.directory/crossTenantAccessPolicy/default/tenantRestrictions/update |

216 −| microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update |

217 −| microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update |

218 −| microsoft.directory/crossTenantAccessPolicy/partners/create |

219 −| microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update |

220 −| microsoft.directory/crossTenantAccessPolicy/partners/delete |

221 −| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update |

222 −| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create |

223 −| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read |

224 −| microsoft.directory/crossTenantAccessPolicy/partners/standard/read |

225 −| microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update |

226 −

227 −#### Cross-tenant access reader

228 −This role can read everything in cross-tenant access settings, including default and organizational based settings. This role should be assigned to users who only need to review settings in cross-tenant access settings, but not manage them.

229 −

230 −The following actions are recommended for this role.

231 −

232 −| Actions |

233 −| ------- |

234 −| microsoft.directory.tenantRelationships/standard/read |

235 −| microsoft.directory/crossTenantAccessPolicy/standard/read |

236 −| microsoft.directory/crossTenantAccessPolicy/default/standard/read |

237 −| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read |

238 −| microsoft.directory/crossTenantAccessPolicy/partners/standard/read |

239 −

240 −#### Cross-tenant access partner administrator

241 −This role can manage everything relating to partners and read the default settings. This role should be assigned to users who need to manage organizational based settings but not be able to change default settings.

242 −

243 −The following actions are recommended for this role.

186 +

244187

245 −| Actions |

246 −| ------- |

247 −| microsoft.directory.tenantRelationships/standard/read |

248 −| microsoft.directory/crossTenantAccessPolicy/standard/read |

249 −| microsoft.directory/crossTenantAccessPolicy/basic/update |

250 −| microsoft.directory/crossTenantAccessPolicy/default/standard/read |

251 −| microsoft.directory/crossTenantAccessPolicy/partners/b2bCollaboration/update |

252 −| microsoft.directory/crossTenantAccessPolicy/partners/b2bDirectConnect/update |

253 −| microsoft.directory/crossTenantAccessPolicy/partners/create |

254 −| microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update |

255 −| microsoft.directory/crossTenantAccessPolicy/partners/delete |

256 −| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/basic/update |

257 −| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/create |

258 −| microsoft.directory/crossTenantAccessPolicy/partners/identitySynchronization/standard/read |

259 −| microsoft.directory/crossTenantAccessPolicy/partners/standard/read |

260 −| microsoft.directory/crossTenantAccessPolicy/partners/tenantRestrictions/update |

188 +You can create custom roles to manage cross-tenant access settings. Learn more about the recommended custom roles [here](reference-cross-tenant-custom-roles.md).

261189

262190 ## Protect cross-tenant access administrative actions

263191

264192 Any actions that modify cross-tenant access settings are considered protected actions and can be additionally protected with Conditional Access policies. For more information about configuration steps, see [protected actions](~/identity/role-based-access-control/protected-actions-overview.md).

265193

266194 ## Identify inbound and outbound sign-ins

267 −

195 +

268196 Several tools are available to help you identify the access your users and partners need before you set inbound and outbound access settings. To ensure you don’t remove access that your users and partners need, you should examine current sign-in behavior. Taking this preliminary step helps prevent loss of desired access for your end users and partner users. However, in some cases these logs are only retained for 30 days, so we strongly recommend you speak with your business stakeholders to ensure required access isn't lost.

269197

270 −### Cross-tenant sign-in activity PowerShell script

271 −

272 −To review user sign-in activity associated with external organizations, use the [cross-tenant user sign-in activity](https://aka.ms/cross-tenant-signins-ps) PowerShell script. For example, to view all available sign-in events for inbound activity (external users accessing resources in the local tenant) and outbound activity (local users accessing resources in an external organization), run the following command:

273 −

274 −```powershell

275 −Get-MSIDCrossTenantAccessActivity -SummaryStats -ResolveTenantId

276 −```

277 −

278 −The output is a summary of all available sign-in events for inbound and outbound activity, listed by external organization ID and external organization name.

279 −

280 −### Sign-in logs PowerShell script

281 −

282 −To determine your users' access to external Microsoft Entra organizations, use the [Get-MgAuditLogSignIn](/powershell/module/microsoft.graph.reports/get-mgauditlogsignin) cmdlet in the Microsoft Graph PowerShell SDK to view data from your sign-in logs for the last 30 days. For example, run the following command:

283 −

284 −```powershell

285 −#Initial connection

286 −Connect-MgGraph -Scopes "AuditLog.Read.All"

287 −Select-MgProfile -Name "beta"

288 −

289 −#Get external access

290 −$TenantId = "<replace-with-your-tenant-ID>"

291 −

292 −Get-MgAuditLogSignIn -Filter "ResourceTenantId ne '$TenantID'" -All:$True |

293 −Group-Object ResourceTenantId,AppDisplayName,UserPrincipalName |

294 −Select-Object count,@{n='Ext TenantID/App User Pair';e={$_.name}}

295 −```

296 −

297 −The output is a list of outbound sign-ins initiated by your users to apps in external organizations.

298 −

299 −### Azure Monitor

300 −

301 −If your organization subscribes to the Azure Monitor service, use the [Cross-tenant access activity workbook](~/identity/monitoring-health/workbook-cross-tenant-access-activity.md) (available in the Monitoring workbooks gallery in the Azure portal) to visually explore inbound and outbound sign-ins for longer time periods.

302 −

303 −### Security Information and Event Management (SIEM) Systems

304 −

305 −If your organization exports sign-in logs to a Security Information and Event Management (SIEM) system, you can retrieve the required information from your SIEM system.

198 +|Tool |Method |

199 +|---------|---------|

200 +|PowerShell script for cross-tenant sign-in activity | To review user sign-in activity associated with external organizations, use the [cross-tenant user sign-in activity](https://aka.ms/cross-tenant-signins-ps) PowerShell script. |

201 +|PowerShell script for sign-in logs | To determine your users' access to external Microsoft Entra organizations, use the [Get-MgAuditLogSignIn](/powershell/module/microsoft.graph.reports/get-mgauditlogsignin) cmdlet. |

202 +|Azure Monitor | If your organization subscribes to the Azure Monitor service, use the [Cross-tenant access activity workbook](~/identity/monitoring-health/workbook-cross-tenant-access-activity.md). |

203 +|Security Information and Event Management (SIEM) systems | If your organization exports sign-in logs to a Security Information and Event Management (SIEM) system, you can retrieve the required information from your SIEM system. |

306204

307205 ## Identify changes to cross-tenant access settings

308206

Cross-tenant access settings

Microsoft's edit · 23 Aug 2024 13:07 UTC