Module 7: External Identities & B2B Collaboration

← Module 6: Conditional Access

Module 7 of 8

Module 8: Connect & Governance →

🎯 Entra ID Course · Module 7 of 8

External Identities & B2B Collaboration

📂 Course: Entra ID Administration
📦 Module: 7 of 8
🎯 Exam: SC-300
⏱ Read time: ~22 min
SC-300
SC-300 Exam Alignment
SC-300

Implement and manage external identities: Configure B2B collaboration, manage external collaboration settings, implement Cross-Tenant Access Settings (inbound/outbound), and manage guest user lifecycle.

  • Know the B2B guest invitation flow and how guests authenticate (with their own identity — Microsoft account, work account, or email OTP)
  • Know the External collaboration settings — who can invite guests and the guest access restriction levels
  • Know Cross-Tenant Access Settings (XTAP): inbound controls what external users can access in YOUR tenant; outbound controls what YOUR users can access in EXTERNAL tenants
  • Know the difference between B2B collaboration (guest access to resources) and B2B direct connect (Teams shared channels)
  • Know that domain allow/block lists for invitations are mutually exclusive — you can use an allow list OR a block list, not both simultaneously
Exam Tip: A guest user in Entra ID is identified by UserType = Guest. Their UPN contains #EXT#. Guests authenticate with their own home identity — your tenant does not issue them a password. Access reviews can be used to periodically verify whether guest access should continue.
Microsoft Entra External ID provides the framework for secure collaboration with people outside your organisation — letting external users use their own identity to access your resources without your tenant managing their credentials.

🤝 B2B Collaboration — Guest User Flow

Step What Happens
1. Invitation Admin or permitted user invites external email address via Entra admin center, PowerShell, Teams, SharePoint, or Microsoft Graph API
2. Guest object created A guest user object (UserType = Guest) is created immediately. They cannot access resources until they redeem the invitation
3. Redemption Guest clicks the invitation link and authenticates with their own identity: Entra account, Microsoft personal account, Google federation, or email OTP
4. Consent Guest consents to sharing their basic profile (display name, email) with your tenant
5. Access granted Guest can now access the specific SharePoint site, Teams channel, or app they were invited to

💡 Guest Authentication — No Password in Your Tenant

Guest users do not have a password in your tenant. They authenticate using their home organisation's identity provider. You cannot reset a guest's password — only their home organisation can. If their account is disabled at home, they immediately lose access to your resources.

⚙️ External Collaboration Settings

Setting Options Notes
Who can invite guests Anyone including guests; Members and specific roles; Only admins; No one Most to least permissive. Recommend "Only admins" for regulated environments
Guest user access Same as members; Limited (default); Restricted — can only see own profile Default limited access lets guests look up users and groups in your directory
Allow or block domains Allow invitations only to listed domains; Block invitations to listed domains Mutually exclusive — allow list OR block list, not both. Allow list is more restrictive

🔄 Cross-Tenant Access Settings (XTAP)


Entra admin center › External Identities › Cross-tenant access settings
Setting What It Controls Example Use
Inbound — B2B collaboration Which external users from other Entra tenants can be invited as guests into YOUR tenant Block all inbound guests from a specific competitor tenant
Inbound — Trust settings Whether you trust MFA and device compliance claims from a specific partner tenant Trust Contoso's MFA — Contoso users don't need to re-do MFA in your tenant
Outbound — B2B collaboration Which of YOUR users can be invited as guests in external tenants Prevent all users from joining external tenants to avoid data exfiltration
Outbound — B2B direct connect Whether your users can create/join external shared Teams channels Allow only Engineering team in external Teams shared channels with partners

🔗 B2B Direct Connect vs B2B Collaboration

B2B Collaboration B2B Direct Connect
User object in your directory? Yes — guest user object created No — external user not in your directory
Primary use case Guest access to SharePoint, Teams, apps, resources Teams shared channels — bidirectional collaboration
Configuration required External collaboration settings + invite Both orgs must configure outbound + inbound B2B direct connect in XTAP
PowerShell — B2B Guest Management

Connect-MgGraph -Scopes 'User.Invite.All','User.ReadWrite.All'

# Invite a single B2B guest user
New-MgInvitation -InvitedUserEmailAddress 'partner@contoso.com' -InvitedUserDisplayName 'Alice Contoso' -InviteRedirectUrl 'https://myapps.microsoft.com' -SendInvitationMessage \$true

# List all guest users
Get-MgUser -Filter "userType eq 'Guest'" | Select-Object DisplayName,UserPrincipalName,Mail,CreatedDateTime

# Get guests who haven't redeemed their invitation yet
Get-MgUser -Filter "userType eq 'Guest' and externalUserState eq 'PendingAcceptance'" | Select-Object DisplayName,Mail

💡 Best Practices

  • Restrict guest invitations to admins only in regulated industries — prevents ungoverned external access accumulating across SharePoint and Teams
  • Configure domain allow lists when your organisation only works with known partners — prevents invitations to personal Gmail or Yahoo addresses
  • Set up quarterly Access Reviews for all guest users — guest accounts accumulate over time and often remain active long after projects end
  • Use Cross-Tenant Access Settings to trust MFA from key partner tenants — reduces friction for trusted partners without lowering security

🎓 Interview Q&A

Q: A partner company's employee needs SharePoint access. Their company uses Google Workspace, not Microsoft 365. Can they be invited as a B2B guest, and how do they authenticate?
Yes. A Google Workspace user can be invited via their Google work email. If Google federation is configured, Entra routes authentication to Google's identity provider. If not, Entra falls back to email one-time passcode (email OTP) — a time-limited code sent to the guest's email address. Either way, the guest authenticates without your tenant issuing them a password.

🎯 SC-300 Mock Test
Module 7 — External Identities & B2B
5 questions · Scenario-based · Pass mark: 70%

Q1 of 5

An external contractor from Fabrikam resets their Fabrikam password 2 weeks after being invited as a guest. What effect does this have on their guest access in your tenant?

AThe guest loses access — password changes in the home tenant invalidate B2B tokens
BThe guest's password must also be reset in your tenant
CNo effect — the guest authenticates against Fabrikam's Entra ID; Fabrikam manages their credentials, not your tenant
DThe invitation must be re-sent after the password change

Q2 of 5

An organisation wants to allow guest invitations only from @fabrikam.com and @contoso.com. How should this be configured?

AExternal collaboration settings → Collaboration restrictions → Allow invitations only to specified domains → Add fabrikam.com and contoso.com
BBlock all domains then add fabrikam.com and contoso.com as exceptions to the block list
CCross-Tenant Access Settings → Add inbound rules allowing only those two domains
DCreate a Conditional Access policy blocking all external users except those domains

Q3 of 5

You want to trust Contoso's MFA so their users don't need to complete MFA again when accessing your SharePoint. Where is this configured?

AExternal collaboration settings → Guest user access → Trust external MFA
BConditional Access → Create a policy exempting Contoso users from MFA
CAuthentication methods → Add Contoso as a trusted identity provider
DCross-Tenant Access Settings → Add Contoso org-specific policy → Inbound trust settings → Trust multifactor authentication from Contoso

Q4 of 5

An external user from a Gmail-based company is invited as a B2B guest. Google federation is not configured in your tenant. How do they authenticate?

AThe invitation cannot be sent — only Microsoft Entra accounts can be invited
BEmail one-time passcode (email OTP) — a time-limited code sent to the guest's Gmail address
CA temporary Microsoft account is created automatically
DThe guest must create a Microsoft personal account first

Q5 of 5

An organisation has 340 stale guest accounts from completed projects. What is the recommended governance approach?

ADelete all 340 guest accounts immediately
BCreate a CA policy blocking all guest accounts
CConfigure a recurring Access Review for all guest users — reviewers confirm access should continue, and auto-remove those not confirmed
DAsk business owners to manually review guest lists quarterly



🔒

Locked — Complete Module 6 first.
Pass the quiz (70%+) to unlock Module 8: Entra Connect, Monitoring & Governance