External IdAM B2B Collaboration in Entra ID

Global Administrator is required because modifying the B2B collaboration allow list is a tenant-wide identity configuration change. Using a dedicated PRV account ensures privileged actions are auditable and separated from day-to-day user activity, following the principle of least privilege.

The External collaboration settings page is the central configuration point for all B2B guest access policies. This is where the tenant-level controls for who can be invited, who can invite, and which domains are permitted or denied are all managed.

The allow list operates as a positive-security model — only domains explicitly added here will be eligible for B2B guest invitations. This prevents unauthorised or unknown organisations from being invited into the R&R tenant, reducing the attack surface for identity-based threats.

Once saved, users who are members of the approved domain can now be invited into R&R as B2B collaboration guests. Invitations sent to any domain not on this allow list will be blocked, ensuring only vetted partner organisations gain access to R&R resources.

Cross-tenant trust settings modify how conditional access policies evaluate external identity claims. The Security Administrator role is the minimum required privilege for these changes, applying least-privilege principles to reduce unnecessary Global Admin elevation.

Cross-tenant access settings control the trust relationship between R&R and external tenants. This is distinct from the allow list — while the allow list controls who can be invited, cross-tenant settings control what security claims are trusted from those partners.

Adding an organisation here creates a per-tenant trust policy that overrides the default cross-tenant settings. This granular approach means each partner can have individually tailored trust configurations rather than a blanket policy applied to all external tenants.

Entra automatically resolves the domain to its underlying tenant ID. Verifying the populated details before clicking Add ensures you are establishing trust with the correct Azure AD / Entra ID tenant, preventing accidental trust with a spoofed or similarly named tenant.

By default, new organisations inherit the tenant-wide default settings (which typically do not trust external MFA claims). Switching to Customise settings allows you to create a bespoke trust policy for this specific partner, enabling fine-grained control over which security claims are accepted.

This is the key configuration step. Once enabled, R&R's conditional access policies will accept MFA claims passed through the cross-tenant connection from the partner's home tenant. Guest users from this organisation can then access R&R resources using their own organisation's credentials and MFA — they will not need to register for a separate R&R MFA token, greatly improving the user experience while maintaining security posture.