Full Guide: Cross-Tenant Access (B2B Direct Connect) — Trust the Right Tenants Only
- Hanna Korotka
- 32 minutes ago
- 2 min read
If your team collaborates with customers, vendors, or MSP partners in Microsoft 365, you need a way to open doors only to trusted organizations—and keep everyone else out. Microsoft Entra’s B2B Direct Connect does exactly that: it lets two tenants create a mutual, fine-grained trust so users can work in shared Teams channels and selected apps without creating guest accounts, while you still enforce your security policies. By default, Direct Connect is blocked for all orgs until you explicitly allow it, which is perfect for SMB zero-trust goals.
Why Cross-Tenant Access matters to SMBs
Problem: spaghetti guest accounts, inconsistent MFA prompts, and risky “allow all” sharing.
Outcome: approve specific partner tenants, inherit (or don’t inherit) their MFA/device claims, and control exactly who can access what—without broad, permanent guest sprawl.
What you’ll configure (high level)
Default stance: keep B2B Direct Connect off for the world.
Organization-specific rules: add only the tenants you trust, then tune inbound (their users → your apps) and outbound (your users → their apps).
Trust settings: choose whether to accept the partner’s MFA and device compliance claims to streamline sign-in while staying secure.
Teams shared channels: enable seamless co-working where needed—both sides must allow the relationship.
Step-by-step: allow only trusted partner tenants
1) Confirm your default posture (deny-by-default)
Microsoft Entra admin center → Entra ID → External Identities → Cross-tenant access settings → Default settings. Leave Direct Connect blocked by default so nothing is open globally. (You can allow “all orgs” for broad collab, but most SMBs should stay selective.)
2) Add a partner organization
Go to Organizational settings → Add organization → enter their primary domain or tenant ID. This creates a container for custom rules for just that tenant.
3) Set Inbound access (their users → your resources)
Inside that organization entry, open Inbound access and switch to B2B direct connect tab. Choose:
Who from the partner can come in (all users/groups vs. specific).
What they can reach (apps/resources)
4) Set Outbound access (your users → their resources)
Inside the organization entry, open Outbound access and switch to B2B direct connect tab. Decide which of your users/groups can access the partner’s resources. This keeps accidental oversharing in check.
5) Configure Trust settings (streamline but verify)
Still within that org entry, open Trust settings and choose whether to trust the partner’s MFA and device compliance claims. Trusting them avoids duplicated MFA enrollment and lets you require compliant devices—even when the device is managed by the partner. Apply this per organization for precision.
6) Light up Teams shared channels
If you’ll collaborate in shared channels, ensure both tenants allow Direct Connect in cross-tenant access; then configure Teams policies for sharing/participation.
Tip: Document each partner’s settings (who, what, trust level) in your runbook so audits are easy.
Governance tips that prevent surprises
Least privilege by tenant: start with narrow groups and a small app list—expand only as needed.
Test sign-in paths: verify MFA and device trust behavior from a partner test account before you roll to production.
Review quarterly: remove stale partners and users, and re-confirm the business need.
How PlexHosted can help
As a Microsoft Cloud MSSP, we strengthen your security posture end to end—hardening identity and access, protecting email and collaboration, securing endpoints with Intune and Defender, governing data with Purview, and improving patching and vulnerability management. We implement secure-by-default baselines, validate controls with measurable checks, and provide ongoing monitoring and rapid response so your Microsoft 365 environment stay resilient and compliant.