Cross-tenant access settings
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5c8b67a · +1 −1 lines · also on GitHub
⋯ 173 unchanged lines
174174
175175
- If you block access to all apps by default, users are unable to read emails encrypted with Microsoft Rights Management Service, also known as Office 365 Message Encryption (OME). To avoid this issue, we recommend configuring your outbound settings to allow your users to access this app ID: 00000012-0000-0000-c000-000000000000. If you allow only this application, access to all other apps is blocked by default.
176176
177
−- If an external organization requires MFA or Terms of Use (ToU) by Conditional Access policies, users might be blocked from registering MFA methods or consenting to ToU. To avoid this issue, configure outbound settings (home tenant) and inbound settings (resource tenant) to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (AAD Terms of Use) for ToU. The configuration of the outbound settings can be achieved via the Microsoft Entra admin center by selecting 'Add other applications' and providing the app ID. Due to a current user interface (UI) limitation the configuration of the inbound settings must be performed via [Microsoft Graph APIs](/graph/api/resources/crosstenantaccesspolicy-overview).
177
+- If an organization requires MFA or Terms of Use (ToU) by Conditional Access policies, users might be blocked from registering MFA methods or consenting to ToU. To avoid this issue, configure outbound settings (home tenant) and inbound settings (resource tenant) to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (AAD Terms of Use) for ToU. The configuration of the outbound settings can be achieved via the Microsoft Entra admin center by selecting 'Add other applications' and providing the app ID. Due to a current user interface (UI) limitation the configuration of the inbound settings must be performed via [Microsoft Graph APIs](/graph/api/resources/crosstenantaccesspolicy-overview).
178178
179179
## Custom roles for managing cross-tenant access settings
180180
<!--Added content as a reference. -->
⋯ 29 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.