# Cross-Tenant Access Settings > Ensures cross-tenant access policies are configured to control B2B inbound and outbound trust settings, preventing unauthorised access from or to external tena… Ensures cross-tenant access policies are configured to control B2B inbound and outbound trust settings, preventing unauthorised access from or to external tenants. ## Settings this baseline controls | Setting | What it does | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | B2B collaboration outbound | Controls whether your users can collaborate outbound with external tenants via B2B collaboration (users and groups). [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | B2B collaboration outbound apps | Controls which applications your users can access in external tenants via B2B collaboration. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | B2B direct connect outbound | Controls whether your users can connect outbound to external tenants via B2B direct connect (users and groups). [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | B2B direct connect outbound apps | Controls which applications your users can access in external tenants via B2B direct connect. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | Tenant restrictions | Controls whether external users can access your tenant resources from unmanaged devices (users and groups). [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | Tenant restrictions apps | Controls which applications external users can access from unmanaged devices. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | B2B collaboration inbound | Controls whether external users can collaborate inbound with your tenant via B2B collaboration (users and groups). [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | B2B collaboration inbound apps | Controls which of your applications external users can access via B2B collaboration. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | **5 more settings** | Setting | What it does | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | B2B direct connect inbound | Controls whether external users can connect inbound to your tenant via B2B direct connect (users and groups). [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | B2B direct connect inbound apps | Controls which of your applications external users can access via B2B direct connect. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | Trust MFA claims | Trust multi-factor authentication claims from external Microsoft Entra organizations. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | Trust compliant devices | Trust compliant device claims from external Microsoft Entra organizations. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | | Trust hybrid-joined devices | Trust hybrid Azure AD joined device claims from external Microsoft Entra organizations. [Learn more](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this to the tenant, or roll it out through a scheme, to set the tenant's default stance on collaborating with every other Microsoft Entra organisation, before anyone configures a one-off exception for a specific partner. 1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **B2B collaboration inbound** and **B2B collaboration outbound** both allowed. This lets your people invite external guests and be invited as guests elsewhere, which most organisations still need day to day. 3. Set **B2B direct connect inbound** and **B2B direct connect outbound** both to blocked. Direct connect is a closer trust relationship (used for things like Teams Connect shared channels), so this baseline keeps it off by default. You can still give a specific partner organisation its own settings in Microsoft Entra without changing this default. 4. Turn on **Trust MFA claims**, **Trust compliant devices** and **Trust hybrid-joined devices**, so a partner organisation's own strong sign-in evidence is accepted here instead of your Conditional Access policies challenging that user again. 5. Save. **Auto-remediation** is safe to turn on: these are tenant-wide defaults, not something an individual partner relationship depends on. ## Check it worked Passing means **Entra ID → External Identities → Cross-tenant access settings → Default settings** shows B2B collaboration allowed both ways, B2B direct connect blocked both ways, and all three trust settings on. Settings you've already made for specific partners are unchanged; end users collaborating with a new, unlisted organisation see the effect of these defaults the next time they try. ## Standards this addresses ### CIS - **M365 5.1.6.x** — CIS M365 Foundations Benchmark 5.1.6.x - **v8 6.8** — CIS Controls v8 Safeguard 6.8 ### NIST - **PR.AC-5** — NIST CSF 2.0 PR.AC-5 - **AC-17** — NIST SP 800-53 AC-17 - **AC-20** — NIST SP 800-53 AC-20 ### ISO 27001 - **A.8.12** — ISO/IEC 27001:2022 Annex A.8.12 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)