Domain 1 of 4 · Chapter 3 of 4

External Identities

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Identity and Access Administrator Associate premium course — no separate purchase.

Included in this chapter:

  • Guest accounts and the two settings planes
  • External collaboration settings: invite, restrict, and bulk
  • Cross-tenant access: inbound, outbound, and trust
  • Cross-tenant synchronization: automated B2B lifecycle
  • External identity providers: SAML and WS-Fed federation

Choosing an external-collaboration mechanism

MechanismB2B collaborationB2B direct connectCross-tenant syncSAML/WS-Fed federation
Creates a guest objectYes (#EXT# UPN)No object createdYes, provisioned automaticallyYes (guest signs in via external IdP)
Default stateEnabledBlockedNo users syncedNot configured
Who configures itInviting (resource) tenantBoth tenants, mutuallySource tenant pushes; target opts inResource tenant adds the IdP
Primary use caseAd hoc partner accessTeams Connect shared channels onlyLifecycle across tenants you ownPartner uses non-Entra IdP credentials
License neededEntra ID Free for basic inviteEntra ID P1 in both tenantsEntra ID P1 per synced user (source)Entra ID Free (P1 not required)

Decision tree

Teams shared channel?collaboration needB2B direct connectno guest object; both tenantsYesTenants you own?one organizationNoCross-tenant syncpush from source; P1 in sourceYesNon-Entra IdP?SAML / WS-Fed partnerNoSAML/WS-Fed federationguest signs in at their own IdPYesB2B collaboration invitedefault; individual or bulk CSVNoAlways: grant access by role, never by changing userType to Memberguests stay guests; widen with Entra roles, app roles, or group membership
Cheat sheet

Cheat sheet

  • A B2B guest authenticates at home and carries a #EXT# UPN
  • Widen a guest's access with roles, not by changing userType
  • External collaboration settings vs cross-tenant access settings are different planes
  • The default guest invite setting lets anyone, including guests, invite
  • The Guest Inviter role can invite even when invites are locked to admins
  • The default guest access level gives limited directory visibility
  • Collaboration restrictions are an allowlist or a blocklist, never both
  • Bulk-invite guests with the CSV template, keeping its first two rows intact
  • Outbound and inbound access settings are configured separately
  • Trust settings are inbound-only and off by default
  • B2B collaboration is on by default and direct connect is blocked by default
  • Automatic redemption suppresses the prompt only when both sides enable it
  • B2B direct connect exists only for Teams shared channels and is mutual
  • Cross-tenant sync is a one-way push configured in the source tenant
  • Cross-tenant sync moves only internal members, never the source's guests
  • Cross-tenant sync needs Entra ID P1 in the source per user
  • Cross-tenant sync is not a migration tool
  • Direct federation lets a partner sign in with their own SAML or WS-Fed IdP
  • A federated SAML IdP must send a persistent NameID and an email claim
  • Domainless federation routes by Issuer URI, and only one is allowed per tenant
  • Tenant restrictions are independent of inbound, outbound, and trust settings
  • Move the federated IdP up the redemption order to use it first
  • New-MgInvitation needs the SignIns module and a required InviteRedirectUrl
  • A B2B invitation never expires and the guest is added to the directory immediately

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Microsoft Entra External ID overview
  2. Default user permissions in Microsoft Entra ID
  3. Configure external collaboration settings
  4. Cross-tenant access overview
  5. Allow or block invitations to B2B users from specific organizations
  6. Bulk invite Microsoft Entra B2B collaboration users
  7. Set up tenant restrictions V2
  8. What is cross-tenant synchronization in Microsoft Entra ID?