Cross-tenant access settings

This page's changes and edits · All guidance changes

Microsoft's edit · 4 Jun 2025 01:42 UTC

Improve guidance for ToU

Microsoft's commit message in MicrosoftDocs/entra-docs · commit ca3a3ab · +1 −1 lines · also on GitHub

⋯ 173 unchanged lines

174174

175175 - If you block access to all apps by default, users are unable to read emails encrypted with Microsoft Rights Management Service, also known as Office 365 Message Encryption (OME). To avoid this issue, we recommend configuring your outbound settings to allow your users to access this app ID: 00000012-0000-0000-c000-000000000000. If you allow only this application, access to all other apps is blocked by default.

176176

177 −- If an external organization requires MFA or Terms of Use (ToU) by Conditional Access policies, users might be blocked from registering MFA methods or consenting to ToU. To avoid this issue, configure outbound settings to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (AAD Terms of Use) for ToU.

177 +- If an external organization requires MFA or Terms of Use (ToU) by Conditional Access policies, users might be blocked from registering MFA methods or consenting to ToU. To avoid this issue, configure outbound settings (home tenant) and inbound settings (resource tenant) to let users access app ID 0000000c-0000-0000-c000-000000000000 (Microsoft App Access Panel) for MFA registration and app ID d52792f4-ba38-424d-8140-ada5b883f293 (AAD Terms of Use) for ToU. The configuration of the outbound settings can be achieved via the Microsoft Entra admin center by selecting 'Add other applications' and providing the app ID. Due to a current user interface (UI) limitation the configuration of the inbound settings must be performed via [Microsoft Graph APIs](/graph/api/resources/crosstenantaccesspolicy-overview).

178178

179179 ## Custom roles for managing cross-tenant access settings

180180

⋯ 29 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 07:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.