Microsoft Entra B2B / External ID Complete Guide: Partner Invitations, Customer Auth, Cross-tenant Settings

Microsoft Entra B2B Collaboration lets you invite users from external organizations (vendors, partners, contractors) as 'guests' into your own Entra ID tenant, enabling collaboration on Microsoft 365 and Azure resources. It is free (up to 50,000 guests), guests authenticate against their home organization's Entra ID (federated), and appear as Guest User in your tenant. Common scenarios: 1) SharePoint sharing projects with partner companies, 2) granting Azure resource access to contractor engineers, 3) sharing Power BI reports with customers, 4) Teams guest invitations, 5) adding external members to Microsoft 365 Groups. You can scope allowed organizations with Cross-tenant Access Settings. As the core feature of Microsoft Entra External Identity, it is deeply tested in SC-300 and MS-102.

B2B Collaboration: invite users from external organizations as guests into your Entra ID tenant for Microsoft 365 collaboration; guests authenticate via their home Entra ID (federated); free up to 50,000 guests. Microsoft Entra External ID for customers (formerly Azure AD B2C, rebranded in 2024): customer authentication for custom apps, independent External Tenant, email/password and social authentication (Google, Facebook, Apple), full UI/flow customization via Custom Policy, MAU-based pricing. Decision guide: 1) Microsoft 365 collaboration with partners → B2B, 2) customer authentication for SaaS custom apps → External ID for customers, 3) organizations with both needs run both. Microsoft has been gradually rebranding B2C as External ID for customers since 2024, and new projects should be built under the new brand.

Standard B2B guest invitation flow: 1) the inviter (internal user, acting as an Entra ID admin or Group Owner) enters the external email address via 'User → Invite external user' in the Entra ID admin center, 2) Microsoft sends an invitation email with an Invitation Redemption Link, 3) the external user clicks the link and authenticates with Entra ID (their organization's Entra ID or a personal Microsoft account), 4) accepts the Privacy Statement and terms of use, 5) a guest account is created in your Entra ID tenant (UserType: Guest), 6) access is granted to the Groups / SharePoint / Teams specified at invitation time, 7) the guest can then access Microsoft 365 / Azure resources like any regular user. You can reduce operational load by automating the Invitation Redemption Process (Self-Service Sign-up, SharePoint Sharing Links, auto-accepted Teams invites). In enterprises, auto-invitation through Access Package + Entitlement Management is the standard pattern.

Cross-tenant Access Settings (GA in 2022) centralizes access control between Entra ID tenants (your tenant ↔ external organizations). Three configuration axes: 1) Inbound Access (external orgs accessing your tenant via B2B Collaboration / Direct Connect), 2) Outbound Access (your users accessing external orgs), 3) Microsoft Cloud Settings (cross-cloud with Azure Government, Azure China). Combine Default Settings (applied to all external orgs) with Organizational Settings (per-org customization) for flexible policies. Typical configurations: 1) default allows all guest invitations with MFA enforced, 2) Direct Connect enabled for specific partners (top 5 organizations), 3) B2B invitations blocked from untrusted countries (e.g., orgs in China or Russia). Conditional Access for Cross-tenant enables finer control (require compliant devices, evaluate sign-in risk). In production, balancing security and business convenience is critical.

Steps to configure External ID for customers: 1) create an External Tenant (independent from the Workforce Tenant; free plan up to 50,000 MAU/month), 2) configure User Flows (built-in auth flows for Sign up + Sign in, Password Reset, Profile Edit), 3) add identity providers (Email + Password by default; Google / Facebook / Apple ID / GitHub optional), 4) customize branding (company logo, background image, custom CSS, custom HTML), 5) register an app via Application Registration, 6) implement authentication with the MSAL library (Authorization Code + PKCE flow), 7) define custom attributes (additional fields collected at sign-up). The Premium plan (MAU-based pricing) unlocks advanced features (Custom Policy, phone auth, risk-based Conditional Access). Common use cases: BtoC e-commerce sites, SaaS customer portals, mobile app customer auth, and user registration platforms for web apps.

Standard pattern for automating B2B invitations with Entitlement Management Access Packages: 1) create an Access Package (e.g., 'Partner Portal Access'), 2) bundle SharePoint sites, Microsoft 365 Groups, and Azure resources under Resources, 3) configure Policy: for external users, choose Specific connected organizations or All configured connected organizations, 4) set up an Approval Workflow (1- or 2-stage approval, designated approvers), 5) use Auto Assignment Policy to auto-assign to users matching specific attributes, 6) configure lifecycle (expiration, renewal eligibility, integration with Access Review), 7) share the Portal URL where partners can request access. Benefits: 1) less manual invitation work for IT, 2) full audit logs of the approval process, 3) automatic access removal on expiration, 4) regular reviews via Access Review. This is essential for large-scale enterprise B2B operations and requires an Entra ID P2 license.

Key practices: 1) explicitly restrict allowed organizations in Cross-tenant Access Settings (Allow-all is dangerous), 2) enforce Conditional Access on guest users (require MFA and compliant devices), 3) automate invitations with Access Package + Entitlement Management, 4) run Access Reviews every 3-6 months to inventory guests and auto-remove unneeded ones, 5) minimize default Guest User Permissions (set Guest user access restrictions to Restricted), 6) ship B2B invitation and sign-in events to Microsoft Sentinel and detect anomalies via KQL, 7) automate sync with large partner orgs via Cross-tenant Synchronization (B2B Auto Provisioning, GA 2023), 8) improve guest experience with External Identity Branding, 9) use Lifecycle Workflows to auto-clean up departed external org members, 10) restrict guest access to sensitive data with Data Loss Prevention. In production, balancing convenience and security is the challenge, and ongoing policy review is essential.

SC-300 (Identity and Access Administrator Associate) is the headline certification — Domain 1 (Identity Management, 20-25%) covers B2B / External ID in depth. Also relevant: MS-102 (Microsoft 365 Administrator Expert) Domain 2 (Identity and Access); SC-100 (Cybersecurity Architect Expert) for the Identity pillar of Zero Trust strategy and external identity integration; AZ-204 (Developer Associate) for implementing External ID authentication from a developer perspective; AZ-104 (Administrator) for the basics. Distinguishing and properly choosing between Microsoft Entra B2B Collaboration and External ID for customers is a recurring exam topic and an essential skill for enterprise identity administrators.