How to Configure Shared Channels, Cross-Tenant Access, and B2B Direct Connect in Microsoft Teams

Cross-organisational collaboration between corporate enterprises, vendors, legal counsels, and strategic partners has historically suffered from severe friction within Microsoft Teams. Under traditional Guest Access models, external contributors had to be explicitly provisioned as directory guests in Microsoft Entra ID (formerly Azure Active Directory). Furthermore, interacting with external channels required users to manually switch tenants within the Teams client, severing them from their home organisation’s notifications and active calls.

Microsoft solved this paradigm with Teams Connect Shared Channels powered by Microsoft Entra B2B Direct Connect. Shared channels enable multi-tenant collaboration without tenant switching: external partners access shared conversations, co-author documents, and attend channel meetings directly within their home Teams interface, while dedicated, isolated SharePoint document libraries maintain zero-trust data segregation.

---

Architectural Overview: Guest Access vs B2B Direct Connect

Understanding the architectural contrast between standard collaboration mechanisms is critical for identity governance and security auditing.

Collaboration Dimension	Standard Guest Access	Private Channels	Teams Connect Shared Channels
Identity Provisioning	Guest account created in Host Entra ID (B2B Collaboration)	Internal home tenant accounts only	Zero guest objects created; uses mutual B2B Direct Connect federation
Client Experience	Requires tenant switching; severs home notifications	Native home view	Native home view; renders alongside internal channels without switching
Underlying Storage	Root Team SharePoint Site Collection	Isolated Child Site Collection	Dedicated, isolated SharePoint Site Collection provisioned per channel
MFA & Device Trust	Host tenant enforces discrete MFA registration	Home tenant Conditional Access	Trust settings ingest external MFA and compliant device claims from partner
Membership Scope	Added to entire Team or discrete chat	Subset of Parent Team members	Can be shared with individuals, entire internal teams, or external partner teams

With B2B Direct Connect, no user object is created in the resource tenant directory. User authentication remains rooted within the partner’s home tenant, while authorization is federated through reciprocal Entra Cross-Tenant Access Policies.

---

Step 1: Configuring Cross-Tenant Access Settings in Microsoft Entra ID

B2B Direct Connect requires mutual agreement: both Tenant A (the host) and Tenant B (the external partner) must explicitly configure inbound and outbound trust relationships within their respective Entra admin centres.

B2B Direct Connect Federation Pipeline:
[Tenant A: Host Organisation]               [Tenant B: External Partner]
   │                                            │
   ├── Outbound Access: Allowed to Tenant B ────┤
   │                                            │
   ├── Inbound Access: Accepts Tenant B ────────┤
   │                                            │
   └── Ingests MFA & Device Compliance Claims ──┘

Configuring the Partner Organization in Entra ID

1. Sign into the Microsoft Entra admin center with Global Administrator or Security Administrator credentials.
2. Navigate to External Identities > Cross-tenant access settings.
3. Select Organizational settings, then click Add organization.
4. Enter the partner organization’s primary domain name (e.g. partnercorp.com) or their 36-character Tenant ID. Click Add.

Configuring Inbound Access Policies

Click the Inbound access link beside the newly added partner:

1. Navigate to the B2B direct connect tab.
2. Under Users and groups, select Customize settings, click Allow access, and choose All users (or restrict access to a designated external security group).
3. Under Applications, choose Allow access and select Office 365 (which encompasses Microsoft Teams and SharePoint Online).
4. Navigate to the Trust settings tab. This is crucial to avoid double-MFA authentication prompts:
   • Tick Trust multi-factor authentication from Microsoft Entra tenants.
   • Tick Trust compliant devices (if requiring partner workstations to satisfy Intune compliance).
5. Click Save.

Configuring Outbound Access Policies

Click the Outbound access link beside the partner organisation:

1. Navigate to the B2B direct connect tab.
2. Under Users and groups, select Customize settings, click Allow access, and designate which internal employees are permitted to collaborate with the external partner.
3. Under Applications, select Allow access to Office 365.
4. Click Save.

Reciprocal Requirement: The external partner’s IT administrative team must execute this identical configuration inside their own Microsoft Entra ID tenant, pointing inbound and outbound trust back to your tenant domain.

---

Step 2: Enabling Shared Channels in the Microsoft Teams Admin Center

Once Entra identity federation is active, administrative policies governing Shared Channels must be validated within Microsoft Teams.

1. Open the Microsoft Teams admin center.
2. In the left-hand navigation pane, select Teams > Teams policies.
3. Select the Global (Org-wide default) policy (or a targeted custom policy).
4. Verify that the following policy toggles are set to On:
   • Create shared channels: Enables team owners to generate shared channels.
   • Invite external users to shared channels: Permits internal channel owners to invite B2B Direct Connect partners.
   • Join external shared channels: Permits internal staff to accept invitations to shared channels hosted by external tenants.
5. Click Save. Allow up to 4 hours for global policy replication across Teams service clusters.

---

Step 3: Creating and Sharing a Shared Channel

With cross-tenant federation and Teams administrative policies active, team owners can instantiate shared channels within the standard desktop client.

Creating the Channel

1. In the Microsoft Teams desktop client, navigate to your target Team.
2. Click the three-dot menu icon (…) beside the Team name and select Add channel.
3. Enter a channel name (e.g. Joint-Architecture-Board) and description.
4. Under Channel type, select Shared from the dropdown menu.
5. Click Create.

Inviting External Partners

In the subsequent membership dialogue:

1. Type the full corporate email address of the external partner (e.g. [email protected]).
2. Teams queries the federated Entra directory. The partner’s profile appears with an external affiliation chip. Select their profile.
3. Click Share.

Alternatively, a team owner can share the channel with an entire external team by selecting Share channel > With a team and entering the partner team owner’s email address. The partner owner can then map their entire team into the shared space.

---

SharePoint Online Site Collection Architecture

To satisfy zero-trust corporate security boundaries, Microsoft Teams provisions a completely isolated, standalone SharePoint Online Site Collection for every created shared channel:

SharePoint Online Storage Segregation:
[Parent Team Site Collection] (https://tenant.sharepoint.com/teams/CoreEngineering)
   ├── General Channel Documents (Accessible strictly to internal team)
   └── Internal Project Files
                                 ≠ (Strict Security Air-Gap)
[Dedicated Shared Channel Site] (https://tenant.sharepoint.com/teams/CoreEngineering-Joint-Architecture-Board)
   └── Shared Files & Co-Authored Deliverables (Accessible to Partner via B2B Direct Connect)

External partners never receive permissions to the primary parent team site collection, protecting internal documentation, intranet portals, and adjacent channel files from unauthorized inspection.

---

Troubleshooting Common Teams Shared Channel Faults

Symptom	Underlying Cause	Remediation Step
Inviting partner returns “We couldn’t find any matches”	Missing Entra B2B Direct Connect configuration or asymmetric policy	Verify both organisations have added each other’s Tenant ID under Entra Cross-tenant access settings with Inbound and Outbound B2B Direct Connect policies set to Allow.
External user encounters continuous MFA loop or conditional access failure	Host tenant is not trusting the partner organisation’s MFA claims	In Entra ID Cross-tenant settings, open the partner’s Inbound policy, navigate to Trust settings, and tick Trust multi-factor authentication from Microsoft Entra tenants.
External partner cannot open or co-author files in the channel	SharePoint external sharing policies conflicting with Teams Connect	In the SharePoint admin center, ensure external sharing settings are not restricted to Only people in your organisation. Verify site collection status for the shared channel.
The option to create a Shared channel is missing from the dropdown	Teams policy restriction or Microsoft 365 licensing limitation	Verify that the user’s assigned Teams Policy has Create shared channels toggled to On in the Teams Admin Center. Check that the tenant holds an active M365 Business or Enterprise licence.

---

Governance and Security Auditing Standards

• Review Active Cross-Tenant Partnerships Quarterly: Maintain an active inventory of federated partner tenants in Entra ID. Immediately purge cross-tenant relationships when joint ventures, vendor contracts, or litigation reviews terminate.
• Enforce Device Compliance Checks: For highly regulated industries (such as banking or aerospace), enable Trust compliant devices in Entra Inbound settings to ensure external participants can only connect using corporate-managed endpoints satisfying MDM benchmarks.
• Audit Channel Sharing via Microsoft Purview: Monitor the Unified Audit Log (UAL) using PowerShell: Search-UnifiedAuditLog -RecordType MicrosoftTeams -Operations "ChannelAdded", "MemberAdded" to track all cross-tenant member additions.