Cross-Tenant Access Settings
Ensures cross-tenant access policies are configured to control B2B inbound and outbound trust settings, preventing unauthorised access from or to external tenants.
Settings this baseline controls
| Setting | What it does |
|---|---|
| B2B collaboration outbound | Controls whether your users can collaborate outbound with external tenants via B2B collaboration (users and groups). Learn more |
| B2B collaboration outbound apps | Controls which applications your users can access in external tenants via B2B collaboration. Learn more |
| B2B direct connect outbound | Controls whether your users can connect outbound to external tenants via B2B direct connect (users and groups). Learn more |
| B2B direct connect outbound apps | Controls which applications your users can access in external tenants via B2B direct connect. Learn more |
| Tenant restrictions | Controls whether external users can access your tenant resources from unmanaged devices (users and groups). Learn more |
| Tenant restrictions apps | Controls which applications external users can access from unmanaged devices. Learn more |
| B2B collaboration inbound | Controls whether external users can collaborate inbound with your tenant via B2B collaboration (users and groups). Learn more |
| B2B collaboration inbound apps | Controls which of your applications external users can access via B2B collaboration. Learn more |
5 more settings
| Setting | What it does |
|---|---|
| B2B direct connect inbound | Controls whether external users can connect inbound to your tenant via B2B direct connect (users and groups). Learn more |
| B2B direct connect inbound apps | Controls which of your applications external users can access via B2B direct connect. Learn more |
| Trust MFA claims | Trust multi-factor authentication claims from external Microsoft Entra organizations. Learn more |
| Trust compliant devices | Trust compliant device claims from external Microsoft Entra organizations. Learn more |
| Trust hybrid-joined devices | Trust hybrid Azure AD joined device claims from external Microsoft Entra organizations. Learn more |
Configure it
Add this to the tenant, or roll it out through a scheme, to set the tenant’s default stance on collaborating with every other Microsoft Entra organisation, before anyone configures a one-off exception for a specific partner.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Leave B2B collaboration inbound and B2B collaboration outbound both allowed. This lets your people invite external guests and be invited as guests elsewhere, which most organisations still need day to day.
-
Set B2B direct connect inbound and B2B direct connect outbound both to blocked. Direct connect is a closer trust relationship (used for things like Teams Connect shared channels), so this baseline keeps it off by default. You can still give a specific partner organisation its own settings in Microsoft Entra without changing this default.
-
Turn on Trust MFA claims, Trust compliant devices and Trust hybrid-joined devices, so a partner organisation’s own strong sign-in evidence is accepted here instead of your Conditional Access policies challenging that user again.
-
Save. Auto-remediation is safe to turn on: these are tenant-wide defaults, not something an individual partner relationship depends on.
Check it worked
Passing means Entra ID → External Identities → Cross-tenant access settings → Default settings shows B2B collaboration allowed both ways, B2B direct connect blocked both ways, and all three trust settings on. Settings you’ve already made for specific partners are unchanged; end users collaborating with a new, unlisted organisation see the effect of these defaults the next time they try.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.