3.3 External Identities and Cross-Tenant Collaboration
Key Takeaways
- Entra External ID provides B2B Collaboration for enterprise partner guest accounts and Azure AD B2C for customer-facing applications.
- Guest access restriction levels (Default, Restricted, Most Restricted) control whether guest users can discover directory users, groups, or application registrations.
- Cross-Tenant Access Settings govern inbound and outbound permissions between Entra ID tenants, including trust settings for MFA, compliant devices, and hybrid joined devices.
- B2B Direct Connect enables seamless cross-tenant Teams shared channel collaboration without creating guest user objects in the resource tenant.
- Entra Identity Governance secures external user lifecycles through Entitlement Management access packages, recurring Access Reviews, and automated Lifecycle Workflows.
3.3 External Identities and Cross-Tenant Collaboration
Modern enterprises collaborate extensively with external partners, contractors, vendors, and customers. Microsoft Entra External ID encompasses capabilities for governing, securing, and streamlining external identity access while preventing identity sprawl and unauthorized access. Security engineers must master Microsoft Entra B2B Collaboration, B2C, Cross-Tenant Access Settings, B2B Direct Connect, and Entra Identity Governance for external users to pass the AZ-500 exam.
1. Entra External ID Overview: B2B Collaboration vs. B2C
Microsoft Entra External ID supports two distinct deployment patterns based on the identity relationship and target audience:
Entra External ID
│
┌─────────────────────┴─────────────────────┐
▼ ▼
B2B Collaboration B2C
(Business-to-Business) (Business-to-Consumer)
│ │
┌────────┴────────┐ ┌────────┴────────┐
▼ ▼ ▼ ▼
Enterprise Guest User White-Labeled Customer App
Partners & Vendors Objects in Tenant Consumer Apps Separate Directory
Architectural Comparison:
- B2B Collaboration (Business-to-Business): Designed for cross-tenant enterprise collaboration. External workers sign in using their existing organizational identities (Microsoft Entra ID, Google Workspaces, Microsoft Accounts, or One-Time Passcodes). Entra ID creates a Guest User object in your directory (
user_partner.com#EXT#@yourtenant.onmicrosoft.com). Guests can be assigned Azure RBAC roles, Entra ID roles, and granted access to internal applications, Teams, and SharePoint sites. - Azure AD B2C (Business-to-Consumer): A separate identity management service built for customer-facing applications. End consumers create new local accounts (username/password) or sign in via consumer social identity providers (Facebook, Apple, Google). B2C operates in a distinct directory structure and uses custom policies via the Identity Experience Framework (IEF) for white-labeled user journeys.
2. Guest User Access Restriction Levels
Microsoft Entra ID allows tenant administrators to enforce directory-wide restriction levels on guest users to prevent unauthorized directory reconnaissance:
| Access Restriction Level | Operational Visibility & Capabilities |
|---|---|
| Default Guest Permissions | Guests have broad directory read permissions. They can search for other users, list all directory groups, view application registrations, and inspect directory properties. |
| Restricted Guest Access (Limited) | Guests can view their own profile details, but cannot search or view other directory users, groups, or tenant configurations. |
| Most Restricted Guest Access | Guests are strictly limited to viewing only their own user object properties and memberships. Cannot enumerate any directory objects. |
External Collaboration Settings
Administrators can restrict who is allowed to send guest invitations:
- Anyone in the organization can invite guest users (including existing guests).
- Member users and users assigned to specific admin roles can invite guest users.
- Only users assigned to specific admin roles can invite guest users (User Administrator / Guest Inviter role).
- No one in the organization can invite guest users (Disables B2B invitations entirely).
3. Guest User Redemption and Authentication Process
When an external user is invited to a tenant via the Entra Portal, PowerShell, Graph API, or Entitlement Management access packages:
[ Admin / System Invites Guest ]
│
▼
[ Invitation Email / Deep Link Sent ]
│
▼
[ Guest Clicks Link & Authenticates with Home IdP / Email OTP ]
│
▼
[ Guest Consents to Permissions Prompt ]
│
▼
[ User State Updates: PendingAcceptance ──> Accepted ]
- Invitation State: The user object is created with
userType: GuestandexternalUserState: PendingAcceptance. - Redemption Flow: The guest opens the invitation link or accesses a shared resource deep link.
- Identity Verification: Entra ID redirects the guest to their home Identity Provider (IdP) (e.g., partner's Entra ID tenant). If no federated IdP exists, Entra ID sends an Email One-Time Passcode (OTP) to validate mailbox ownership.
- Consent & Access: The guest accepts the organization's privacy consent prompt. The account state changes to
Accepted, and access is granted.
4. Cross-Tenant Access Settings and B2B Direct Connect
Cross-tenant access settings provide granular inbound and outbound governance between your Entra ID tenant and external Entra ID organizations.
Your Tenant (Resource) External Tenant (Home)
┌────────────────────────┐ ┌────────────────────────┐
│ Inbound Settings: │ │ Outbound Settings: │
│ - Allow/Block Partner │ <────────── │ - Allow Users to Access│
│ - Trust Home MFA │ Cross- │ External Tenants │
│ - Trust Compliant Dev │ Tenant │ │
└────────────────────────┘ Policy └────────────────────────┘
Inbound vs. Outbound Access Settings
- Inbound Access Settings: Control whether users from specific external Entra ID tenants can access resources in your tenant.
- Outbound Access Settings: Control whether your internal users can access resources in external Entra ID tenants.
B2B Direct Connect
- Unlike standard B2B Collaboration (which creates a
#EXT#guest user object in your directory), B2B Direct Connect enables two-way mutual trust between two Entra ID tenants without creating guest account objects. - Primarily used to enable Microsoft Teams Shared Channels, allowing external users to collaborate inside shared channels natively using their home tenant credentials.
Cross-Tenant Trust Settings (Inbound)
To prevent requiring external users to register MFA twice (once in home tenant, once in host tenant), Cross-Tenant Access Settings allow host tenants to trust security assertions from external Entra ID tenants:
- Trust Multi-Factor Authentication (MFA): Accepts MFA completed in the guest's home tenant to satisfy your tenant's Conditional Access MFA policies.
- Trust Compliant Devices: Accepts Intune device compliance status from the guest's home tenant.
- Trust Hybrid Entra Joined Devices: Accepts hybrid join claims from the guest's home tenant.
5. Entra Identity Governance for External Users
Managing external identity lifecycles dynamically prevents "stale guest account accumulation" and unauthorized access retention.
┌────────────────────────────────────────────────────────────────────────┐
│ Entra Identity Governance │
│ │
│ ┌───────────────────────┐ Access Package ┌────────────────────────┐ │
│ │ Entitlement Management │ ─────────────> │ Groups, Apps, SP Sites │ │
│ └───────────┬───────────┘ └────────────────────────┘ │
│ │ │
│ ▼ Periodic Evaluation │
│ ┌───────────────────────┐ Denied/Expired ┌────────────────────────┐ │
│ │ Access Reviews │ ─────────────> │ Auto-Revoke Access & │ │
│ └───────────────────────┘ │ Remove Guest Account │ │
└────────────────────────────────────────────────────────────────────────┘
1. Entitlement Management & Access Packages
- Access Packages: Bundles of resources (Entra groups, enterprise applications, SharePoint Online sites) packaged together with predefined approval workflows and assignment policies.
- Connected Organizations: Defines external partner domains whose users are eligible to request access packages self-service.
- Automatic Lifecycle Rules: Access packages can be set to automatically expire after a specified duration (e.g., 180 days).
2. Access Reviews for Guests
- Requires resource owners, guest managers, or guests themselves to periodically re-certify the business justification for guest access.
- Auto-Apply Decisions: If a reviewer fails to respond or denies access, Entra ID can automatically remove the guest user from groups/access packages or block guest sign-in (
accountEnabled: false) and trigger guest account deletion after a grace period.
3. Lifecycle Workflows
- Automates guest onboarding and offboarding tasks (e.g., automatically sending welcome communications, adding guest users to temporary security groups upon arrival, and purging guest accounts when contracts terminate).
An organization wants external partner users to collaborate in Microsoft Teams shared channels without creating guest user objects in the resource tenant's Microsoft Entra ID directory. Which cross-tenant technology enables this capability?
An Azure administrator needs to enforce a restriction where external guest users can only view their own directory user profile and cannot inspect other users, groups, or directory objects. Which Entra guest user access level must be selected?
How can an organization ensure that external partner accounts automatically undergo periodic access re-certification, with access being automatically revoked if partner managers fail to respond?