Historically, when two companies partnered on a project, IT was forced to choose between two bad options: either create duplicate Active Directory accounts for the partner’s employees (adding licensing costs and massive credential theft risk), or configure complex, rigid Active Directory Federation Services (AD FS) trusts that exposed entire directory subtrees.
Microsoft Entra ID B2B Collaboration solved this by allowing “Guest” users. A guest user logs in using their own company’s credentials, but accesses resources in your tenant. However, this created a new problem: MFA Fatigue. If a user was forced to complete an MFA prompt in their home tenant, and then immediately forced to complete a second MFA prompt when accessing your tenant, productivity plummeted.
The solution is Cross-Tenant Access Settings. This advanced security feature allows an organization to forge granular, bidirectional trust relationships with specific external Entra ID tenants. Crucially, it allows your tenant to trust the MFA claims and device compliance states generated by the partner’s tenant, creating a seamless, secure, single-sign-on experience across organizational boundaries.
This guide explains how to architect and enforce secure Cross-Tenant Access Settings for B2B collaboration.
Understanding the Default State
By default, Entra ID allows inbound and outbound B2B collaboration with all external Entra ID tenants, but it does not trust their security claims.
If your Conditional Access policy requires MFA to access SharePoint, and an external guest logs in, your tenant will force them to register for a new MFA method (like an SMS code) specifically for your tenant, ignoring the fact that they just used a YubiKey to log into their home tenant 30 seconds ago.
Step 1: Configuring Default Cross-Tenant Settings
Before forging specific partnerships, you must secure the baseline.
- Navigate to the Microsoft Entra admin center (entra.microsoft.com).
- Go to External Identities > Cross-tenant access settings.
- Click on the Default settings tab.
Under Inbound access settings (how external users access your resources), click Edit inbound defaults. Leave B2B collaboration allowed, but under the Trust settings tab, ensure that Trust multifactor authentication from Microsoft Entra tenants is unchecked. You should only explicitly trust specific, vetted partners, not the entire internet.
Step 2: Adding a Specific Partner Tenant
Assume your company (Contoso) is partnering with an external vendor (Fabrikam). You have audited Fabrikam’s security posture and verified they enforce strict FIDO2 MFA for their employees.
- In the Cross-tenant access settings menu, click the Organizational settings tab.
- Click Add organization.
- Type in the partner’s domain name (e.g.,
fabrikam.com) or their Tenant ID, and click Add. - The organization will now appear in the list.
Step 3: Configuring Inbound Trust for the Partner
Now, we will configure the specific trust parameters for Fabrikam.
- Click the Inbound access link next to Fabrikam in the list.
- Navigate to the Trust settings tab.
- Check the box for Customize settings.
- Check the box for Trust multifactor authentication from Microsoft Entra tenants.
(Optional but Highly Recommended): If you use Intune, you can also check Trust compliant devices. This allows your Conditional Access policies to evaluate if the Fabrikam user is on a corporate-managed, compliant laptop, rather than a personal device, without requiring you to enroll their laptop into your MDM.
Click Save.
Step 4: Restricting Outbound Access (Data Exfiltration Prevention)
Cross-Tenant Access Settings aren’t just for inbound guests; they are a critical Data Loss Prevention (DLP) tool for outbound traffic.
A common data exfiltration vector involves a malicious employee creating a free, personal Entra ID tenant (e.g., hacker_tenant.onmicrosoft.com). While logged into their corporate laptop, they log into their personal tenant’s SharePoint instance and upload gigabytes of corporate source code. Because the traffic is going to a legitimate Microsoft IP address, the corporate firewall allows it.
To stop this, you restrict outbound B2B access.
- Go back to Default settings and click Edit outbound defaults.
- Under B2B collaboration, change Access status to Block access.
This globally bans your employees from logging into any external Entra ID tenant using their corporate identity.
To allow them to collaborate with Fabrikam, you return to the Organizational settings, click Outbound access for Fabrikam, select Customize settings, and explicitly Allow access.
Step 5: Enforcing the Trust via Conditional Access
Finally, ensure your Conditional Access policies are configured to leverage this trust. In your standard “Require MFA for All Users” policy, ensure that the Users assignment explicitly includes All guest and external users. Because you configured the Cross-Tenant Trust, when the Fabrikam user triggers this policy, Entra ID will accept the MFA token embedded in the SAML assertion from Fabrikam, satisfying the requirement seamlessly.
Conclusion
Microsoft Entra ID Cross-Tenant Access Settings fundamentally alter the B2B collaboration landscape. By configuring granular, explicit trust relationships, identity architects can simultaneously eradicate MFA fatigue for trusted partners and deploy ironclad outbound restrictions to prevent malicious data exfiltration, balancing absolute security with seamless productivity.