3.3.2. Cross-Tenant Access and Synchronization
💡 First Principle: Trust between tenants deserves per-partner configuration, not one global dial. Cross-tenant access settings let you say, for this partner specifically: what our users may reach outbound, what their users may do inbound, and — crucially — whether we accept their tenant's MFA and device claims instead of forcing our own.
Cross-tenant access settings have default settings (applying to all unlisted tenants) plus organization-specific overrides. Each side configures B2B collaboration inbound/outbound (allow/block by users, groups, applications), and trust settings — the exam's favorite: accept the partner tenant's MFA, compliant device, and hybrid-joined device claims. Without MFA trust, a partner user satisfying their MFA still gets re-prompted by your CA; with it, their home-tenant MFA satisfies your policy — the standard fix for "partners complain about double MFA."
B2B direct connect is the second channel: no guest object at all — users appear in the partner's Teams shared channels with their home identity, governed entirely by cross-tenant access direct-connect settings. Compare:
| B2B collaboration | B2B direct connect | |
|---|---|---|
| Object in your tenant | Guest user object | None |
| Works with | Most Entra-integrated apps | Teams shared channels (primarily) |
| Governance surface | CA on the guest, reviews, entitlement mgmt | Cross-tenant access settings only |
| Sign-in experience | Redeem once, then guest sign-in | Seamless from home tenant |
Cross-tenant synchronization automates multitenant organizations (conglomerates, mergers): a source tenant provisions B2B users into target tenants automatically (create/update/delete), so users appear in partner GALs and app assignments without manual invites. It rides the provisioning engine (attribute mappings, scoping filters), requires the target to allow inbound sync in cross-tenant access settings, and creates B2B users marked for seamless redemption. It is for tenants you own or tightly partner with — not arbitrary suppliers.
⚠️ Exam Trap: Cross-tenant access settings ≠ cross-tenant synchronization: settings are the trust policy layer (allow/block, claim trust), sync is a provisioning engine that depends on those settings. "Automatically create users from our subsidiary tenant" → sync; "stop double-MFA for the subsidiary's users" → trust settings.
Reflection Question: Your tenant requires compliant devices for a finance app. A trusted partner's users must use it from their own managed laptops. Which exact trust setting makes this work, and what are you now trusting the partner to operate correctly?
