Cross-tenant access settings

This page's changes and edits · All guidance changes

Microsoft's edit · 20 Mar 18:36 UTC

userstory538965

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 674c2da · +10 ~~−10~~ lines · also on GitHub

⋯ 13 unchanged lines

1414

1515 Microsoft Entra organizations can use External ID cross-tenant access settings to manage collaboration with other Microsoft Entra organizations and Microsoft Azure clouds through B2B collaboration and [B2B direct connect](cross-tenant-access-settings-b2b-direct-connect.md). The [cross-tenant access settings](cross-tenant-access-settings-b2b-collaboration.yml) provide granular control over inbound and outbound access, allowing you to trust multifactor authentication (MFA) and device claims from other organizations.

1616

17 −This article covers cross-tenant access settings for managing B2B collaboration and B2B direct connect with external Microsoft Entra organizations, including across Microsoft clouds. Other settings are available for B2B collaboration with non-Microsoft Entra identities (for example, social identities or non-IT managed external accounts). These [external collaboration settings](external-collaboration-settings-configure.md) include options for restricting guest user access, specifying who can invite guests, and allowing or blocking domains.

17 +This article covers cross-tenant access settings for managing B2B collaboration and B2B direct connect with external Microsoft Entra organizations, including across Microsoft clouds. Other settings are available for B2B collaboration with non-Microsoft Microsoft Entra identities (for example, social identities or non-IT managed external accounts). These [external collaboration settings](external-collaboration-settings-configure.md) include options for restricting guest user access, specifying who can invite guests, and allowing or blocking domains.

1818

1919 There are no limits to the number of organizations you can add in cross-tenant access settings.

2020

⋯ 34 unchanged lines

5555 - **B2B collaboration**: Use cross-tenant access settings to manage inbound and outbound B2B collaboration and scope access to specific users, groups, and applications. You can set a default configuration that applies to all external organizations, and then create individual, organization-specific settings as needed. Using cross-tenant access settings, you can also trust multifactor (MFA) and device claims (compliant claims and Microsoft Entra hybrid joined claims) from other Microsoft Entra organizations.

5656

5757 > [!TIP]

58 − > We recommend excluding external users from the [Microsoft Entra ID Protection MFA registration policy](~/id-protection/howto-identity-protection-configure-mfa-policy.md), if you are going to [trust MFA for external users](authentication-conditional-access.md#mfa-for-azure-ad-external-users). When both policies are present, external users won’t be able to satisfy the requirements for access.

58 + > Consider excluding external users from the [Microsoft Entra ID Protection MFA registration policy](~/id-protection/howto-identity-protection-configure-mfa-policy.md), if you're going to [trust MFA for external users](authentication-conditional-access.md#mfa-for-azure-ad-external-users). When both policies are present, external users aren't able to satisfy the requirements for access.

5959

6060 - **B2B direct connect**: For B2B direct connect, use organizational settings to set up a mutual trust relationship with another Microsoft Entra organization. Both your organization and the external organization need to mutually enable B2B direct connect by configuring inbound and outbound cross-tenant access settings.

6161

⋯ 32 unchanged lines

9494 SAML/WS-Fed identity provider federation (Direct federation) is now supported for Microsoft Entra ID verified domains. This feature allows you to set up a Direct federation with an external identity provider for a domain that is verified in another Microsoft Entra tenant

9595

9696 > [!NOTE]

97 −> Ensure that the domain is not verified in the same tenant in which you are trying to set up the Direct federation configuration.

98 −Once you have set up a Direct federation, you can configure the tenant’s redemption preference and move SAML/WS-Fed identity provider over Microsoft Entra ID through the new configurable redemption cross-tenant access settings.

97 +> Ensure that the domain isn't verified in the same tenant in which you're trying to set up the Direct federation configuration.

98 +Once you've set up a Direct federation, you can configure the tenant’s redemption preference and move SAML/WS-Fed identity provider over Microsoft Entra ID through the new configurable redemption cross-tenant access settings.

9999

100100 When the guest user redeems the invite, they see a traditional consent screen and are redirected to the My Apps page. In the resource tenant, the profile for this direct federation user shows that the invite is successfully redeemed, with external federation listed as the issuer.

101101

⋯ 20 unchanged lines

122122 - Accounts your users created in unknown tenants.

123123 - Accounts that external organizations gave to your users so they can access that organization's resources.

124124

125 −We recommend configuring your tenant restrictions to disallow these types of external accounts and use B2B collaboration instead. B2B collaboration gives you the ability to:

125 +Configure your tenant restrictions to disallow these types of external accounts and use B2B collaboration instead. B2B collaboration gives you the ability to:

126126

127127 - Use Conditional Access and force multifactor authentication for B2B collaboration users.

128128 - Manage inbound and outbound access.

⋯ 11 unchanged lines

140140 - Microsoft Azure commercial cloud and Microsoft Azure operated by 21Vianet (operated by 21Vianet)

141141

142142 > [!NOTE]

143 −> B2B direct connect is not supported for collaboration with Microsoft Entra tenants in a different Microsoft cloud.

143 +> B2B direct connect isn't supported for collaboration with Microsoft Entra tenants in a different Microsoft cloud.

144144

145145 For more information, see the [Configure Microsoft cloud settings for B2B collaboration](cross-cloud-settings.md) article.

146146

147 −[Cross-cloud synchronization](~/identity/multi-tenant-organizations/cross-tenant-synchronization-overview.md) settings allows you to manage the lifecycle of users acoss tenants in your organization from different Microsoft clouds. After you enable cross-tenant synchronization settings, you can start synchronizing user data from that cloud.

147 +[Cross-cloud synchronization](~/identity/multi-tenant-organizations/cross-tenant-synchronization-overview.md) settings allows you to manage the lifecycle of users across tenants in your organization from different Microsoft clouds. After you enable cross-tenant synchronization settings, you can start synchronizing user data from that cloud.

148148

149149 ## Important considerations

150150

⋯ 4 unchanged lines

155155

156156 - To configure trust settings or apply access settings to specific users, groups, or applications, you need a Microsoft Entra ID P1 license. The license is required on the tenant that you configure. For B2B direct connect, where mutual trust relationship with another Microsoft Entra organization is required, you need a Microsoft Entra ID P1 license in both tenants.

157157

158 −- Cross-tenant access settings are used to manage B2B collaboration and B2B direct connect with other Microsoft Entra organizations. For B2B collaboration with non-Microsoft Entra identities (for example, social identities or non-IT managed external accounts), use [external collaboration settings](external-collaboration-settings-configure.md). External collaboration settings include B2B collaboration options for restricting guest user access, specifying who can invite guests, and allowing or blocking domains.

158 +- Cross-tenant access settings are used to manage B2B collaboration and B2B direct connect with other Microsoft Entra organizations. For B2B collaboration with non-Microsoft Microsoft Entra identities (for example, social identities or non-IT managed external accounts), use [external collaboration settings](external-collaboration-settings-configure.md). External collaboration settings include B2B collaboration options for restricting guest user access, specifying who can invite guests, and allowing or blocking domains.

159159

160160 - To apply access settings to specific users, groups, or applications in an external organization, you need to contact the organization for information before configuring your settings. Obtain their user object IDs, group object IDs, or application IDs (*client app IDs* or *resource app IDs*) so you can target your settings correctly.

161161

⋯ 8 unchanged lines

170170

171171 - If you want to allow B2B direct connect with an external organization and your Conditional Access policies require MFA, you must configure your trust settings to accept MFA claims from the external organization.

172172

173 −- If you block access to all apps by default, users are unable to read emails encrypted with Microsoft Rights Management Service, also known as Office 365 Message Encryption (OME). To avoid this issue, we recommend configuring your outbound settings to allow your users to access this app ID: 00000012-0000-0000-c000-000000000000. If you allow only this application, access to all other apps is blocked by default.

173 +- If you block access to all apps by default, users are unable to read emails encrypted with Microsoft Rights Management Service, also known as Office 365 Message Encryption (OME). To avoid this issue, configure your outbound settings to allow your users to access this app ID: 00000012-0000-0000-c000-000000000000. If you allow only this application, access to all other apps is blocked by default.

174174

175 −- If an organization requires MFA or Terms of Use (ToU) by Conditional Access policies, users might be blocked from registering MFA methods or consenting to ToU. To avoid this issue, configure outbound settings (home tenant) and inbound settings (resource tenant) to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (AAD Terms of Use) for ToU. The configuration of the outbound settings can be achieved via the Microsoft Entra admin center by selecting 'Add other applications' and providing the app ID. Due to a current user interface (UI) limitation the configuration of the inbound settings must be performed via [Microsoft Graph APIs](/graph/api/resources/crosstenantaccesspolicy-overview).

175 +- Conditional Access policies that require MFA or Terms of Use (ToU) can prevent users from completing MFA registration or ToU consent. To avoid this issue, configure outbound settings (home tenant) and inbound settings (resource tenant) to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (Microsoft Entra Terms of Use) for ToU. The configuration of the outbound settings can be achieved via the Microsoft Entra admin center by selecting 'Add other applications' and providing the app ID. Due to a current user interface (UI) limitation, the configuration of the inbound settings must be performed via [Microsoft Graph APIs](/graph/api/resources/crosstenantaccesspolicy-overview).

176176

177177 ## Custom roles for managing cross-tenant access settings

178178

⋯ 29 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.