L3. External Identities: B2B Collaboration and Guest Access

External Identities Overview

Entra ID External Identities enables your organization to securely share resources with people outside your organization. The SC-300 exam tests three external identity models:

B2B Collaboration (Guest Access)

B2B collaboration is the most heavily tested external identity feature on the SC-300. When you invite an external user, a guest user object is created in your tenant. The guest authenticates using their home organization's identity provider. Invitation flow:

1. Admin or authorized user sends invitation (email or direct link)
2. External user redeems the invitation
3. A guest user object is created in the resource tenant (UserType = Guest)
4. Guest user accesses resources according to assigned permissions

Exam tip: Guest users authenticate at their home tenant, not yours. Your tenant trusts their IdP. If the guest's home org enforces MFA, that does not automatically satisfy your MFA requirements. You must configure your own Conditional Access policies for guests.

Redemption Order

When a guest redeems an invitation, Entra ID attempts authentication in this order:

1. Entra ID: If the guest's email domain matches a verified Entra ID tenant
2. SAML/WS-Fed federation: If you configured direct federation with the guest's IdP
3. Google federation: If configured and the guest has a Gmail account
4. One-time passcode (OTP): Fallback when no other method works

Exam tip: Email one-time passcode is the fallback authentication method. It is enabled by default for all tenants. If a question asks how a guest from a non-Entra organization with no federation can sign in, the answer is email OTP.

Cross-Tenant Access Settings

Cross-tenant access settings let you control inbound and outbound collaboration at a granular level:

• Inbound settings: Control what external users can access in your tenant
• Outbound settings: Control what your users can access in other tenants
• Trust settings: Decide whether to trust MFA, compliant devices, or hybrid-joined device claims from external organizations

You can configure default settings (apply to all organizations) and organization-specific overrides.

B2B Direct Connect

B2B direct connect creates a mutual trust between two Entra ID tenants. Users do not get guest objects in the resource tenant. Instead, they access shared resources (primarily Teams shared channels) using their home identity directly. Key difference from B2B collaboration: No guest object is created. The user is not visible in your directory. This limits the resources they can access to only B2B direct connect-enabled applications.

External Collaboration Settings

Under Entra admin center > External Identities > External collaboration settings, you control:

• Who can invite guests (admins only, members, or everyone including guests)
• Which domains to allow or block for invitations
• Whether guests can be invited to specific groups or apps

Exam tip: The most restrictive invitation setting ("Only users assigned to specific admin roles") requires the Guest Inviter role. Regular member users cannot invite guests when this setting is active.