This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 04 · Appendix

Appendix C — Partner Access Profile (Microsoft Entra)

The Microsoft Entra implementation profile for the External Partner Person class: the default route through a connected organization and an access package with sponsor, approver and expiry; the cross-tenant access settings and Conditional Access scope that go with it; cross-tenant synchronization as a recorded exception with a required Guest user type, matching, deletion threshold, quarantine and partner-exit cleanup; the profile record; copy-paste validation tests in Microsoft Graph PowerShell; monitoring; the tenant strategy (multitenant organizations and templates, Tenant Governance discovery and delegated administration, tenant restrictions v2); the requirements, KSI and evidence map; and the government-cloud availability check.

A partner account gets access because a sponsor asked, an approver agreed and a date was set, never because it exists or synchronized.

NoteIn this appendix

How the agency’s Entra tenant admits External Partner Persons. The default route: a connected organization and an access package. The cross-tenant access settings and the Conditional Access scope that go with it, and why the user type decides which policies apply. Cross-tenant synchronization as an exception, with the settings it must carry. The profile record, ten validation tests as copy-paste commands, and monitoring. Then the tenant strategy for tenants the agency itself owns or finds: multitenant organizations and their templates, Tenant Governance discovery and delegated administration, and tenant restrictions v2. The requirements, KSIs and evidence for each step, and a government-cloud availability check, close the appendix.

Book 03, Chapter 15 defines the External Partner Person class: the partner is authoritative for affiliation and the source credential; the agency for federation trust, access eligibility, authorization, monitoring, review, suspension and termination. This appendix is the Entra profile of that standard, and Book 03, Appendix D is the vendor-neutral record filled in from it. The Externals persona (Chapter 03) is the Conditional Access view of the same people.

The profile covers partners whose people sign in through their own Microsoft Entra tenant or through a SAML or WS-Fed identity provider. Hybrid cases, such as Kerberos realm trusts or forest trusts to a partner, stay in Book 02, Chapter 10. The examples use the fictional agency contoso.example and the partners fabrikam.example (a state agency on Entra ID) and tailspin.example (a regulated entity with its own identity provider).

The default route: a connected organization and an access package

For partners outside the agency’s own organization, the route is entitlement management with B2B collaboration guests. Microsoft’s own guidance points the same way: “For privacy reasons, cross-tenant synchronization is intended for use within an organization. Consider using entitlement management for inviting B2B collaboration users across organizations.”¹ Chapter 09 already governs guests this way, so this section adds only the partner-specific settings.

1. One connected organization per partner. Its authentication type can be Entra ID in the same cloud, Entra ID in another cloud, SAML/WS-Fed federation, one-time passcode, or Microsoft account.² The profile allows the first three. Internal sponsors (agency members) and external sponsors (partner guests already in the directory) can both act as approvers.³ The agency sponsor is a named internal sponsor on every connected organization (design guidance).
2. Configured, never proposed. A policy open to “All users” creates proposed connected organizations automatically.⁴ The profile never uses it: each partner policy targets Specific connected organizations (allowedTargetScope = specificConnectedOrganizationUsers).⁵ A proposed connected organization is a finding.
3. One access package per partner use case, in a catalog enabled for external users, and hidden so only people with the request link find it.⁶ The sponsor sends the link to the partner’s point of contact.
4. Approval, then expiry. Stage 1 is the agency sponsor. Stage 2 is the resource owner for R1 and R2 applications (the application risk tiers of Chapter 06), using the chains in Chapter 09. Expiry is at most 365 days, with extension on sponsor approval (Chapter 09).
5. Quarterly sponsor review. Packages and groups with partner guests are reviewed quarterly by the sponsor, with denied guests removed (Chapter 09).
6. End with the last assignment. The default blocks sign-in when a governed guest loses their last assignment and removes the account after 30 days;⁷ the profile keeps it: externalUserLifecycleAction = blockSignInAndDelete, durationUntilExternalUserDeletedAfterBlocked = 30 days.⁸
7. No side doors. Set “Guests can invite” to No, so guests can’t invite outside entitlement management.⁹

Learn advises excluding the Entitlement Management app from Conditional Access policies that affect guests, or device, location or MFA re-registration requirements can block My Access.¹⁰ CA009 requires MFA of partner users on all resources (Appendix A). Test T1 shows whether a partner user can still request. If not, record an exclusion of that one app in the exception register; don’t loosen CA009 (design guidance).

Tenant relationship and cross-tenant access settings

Every partner on Entra ID gets an organization-specific entry in cross-tenant access settings. Organizational settings override the defaults, and MFA and device claims from other tenants aren’t trusted by default.¹¹¹² The mechanics, and the program’s inbound allowlist, are in Book 02, Chapter 10. Book 07, Chapter 09 covers PIV-backed partners. The profile values are design guidance:

Setting	Profile value	Why
Inbound B2B collaboration	Allowed for the partner tenant only, scoped to the access package’s applications	Default-deny for every other tenant (Book 02’s allowlist)
Outbound B2B collaboration	Not changed by this profile	Agency users visiting the partner are a separate decision
B2B direct connect	Blocked	Not part of the partner route
Trust MFA	On only where the agreement says the partner enforces MFA at home and Conditional Access still requires the strength	Trusting MFA keeps the agency’s MFA policies; it only skips the second prompt13
Trust compliant device	Off unless the agreement names the partner’s device-compliance standard	The agency can’t see the partner’s compliance policy
Trust hybrid joined device	Off	Same reason
Automatic redemption (inbound)	Off on the default route; on only with the sync exception, where it’s required14	The default route has no reason to suppress the consent prompt
Microsoft cloud settings	On only for a partner in another Microsoft cloud	Enabling a cloud blocks all B2B collaboration with it until a tenant from that cloud is added by tenant ID15; see the government-cloud check
Tenant restrictions	Recorded, not set here	They govern agency users’ external accounts on agency devices, independent of inbound settings1617; see the tenant strategy

The record holds the partner’s immutable tenant ID and the names Entra resolves it to (test T0). A partner domain that resolves to another tenant is a stop condition. Changes to these settings are audited under CrossTenantAccessSettings.¹⁸

For a partner on SAML/WS-Fed federation, such as tailspin.example, Conditional Access can require only the MFA grant, not an authentication strength, so the agreement must establish whether the partner’s method is phishing-resistant (Book 07, Chapter 09).

Defaults, allowlist criteria and the partner register

A Zero Trust assessment reads the tenant-wide defaults, not the partner entries: inbound B2B collaboration open to every tenant, outbound open to every tenant, or no tenant restrictions policy. The partner entries above only mean something when the defaults behind them are closed. This subsection sets the defaults, states when a tenant goes on the allowlist or the blocklist, names the partner register, and adds the validation test for tenant restrictions. The conventions are Book 00, Appendix D’s.

Authority: risk-based recommended (the program’s default-deny position, carried from Book 02, Chapter 10); Microsoft documents the settings and their defaults.¹⁹²⁰ Applies: all tenants; organization-specific settings for selected users and groups need Entra ID P1 or P2.²¹ Environment-dependent: tenant restrictions v2 and Tenant Governance government-cloud availability is not yet specified (Government clouds); universal tenant restrictions depends on Global Secure Access, not supported in GCC High or DoD (Chapter 07).

Default setting	Microsoft’s default	Program value
Inbound B2B collaboration	Allowed for all external tenants	Blocked for all external users and applications; each partner is allowed by its own entry. Learn notes that blocking all external users and groups also requires blocking all internal applications in the same setting22
Outbound B2B collaboration	Allowed	Blocked; agency users reach a partner only through an entry that allows named groups and applications
B2B direct connect, inbound and outbound	Blocked	Blocked (unchanged)
Inbound trust (MFA, compliant device, hybrid joined device)	Not trusted	Not trusted (unchanged); trust is set per partner only
Automatic redemption	Off; can’t be changed in the defaults23	Off
Tenant restrictions v2	No policy	Block external accounts and applications (Tenant restrictions v2)

SharePoint and OneDrive invitations through the B2B integration also check the domain allowlist in external collaboration settings, so a partner domain must be on that list too, or invitations from those apps can fail even with the cross-tenant entry in place.²⁴

Allowlist and blocklist criteria (program decision; the 90-day rule below is settled as WD-147). A tenant gets an allowing entry only when all of these hold: a signed agreement names it; an internal sponsor is named on its connected organization; its tenant ID is verified (T0); the agreement states its MFA standard; and the IGO has added it to the partner tenant list. It loses the entry when the agreement ends, when no access package for it has had an active assignment for 90 days, or at the security office’s direction after an incident at the partner. A tenant gets an explicit blocking entry, rather than relying on the default, when the governance office quarantines it as unsanctioned (Chapter 09) or the security office names it as hostile, so a later change to the defaults can’t reopen it.

The partner register is the set of profile records, one per partner and use case, plus the partner tenant list the IGO owns. The register, the organization-specific entries and the {tenant:partners} list in the five partner policies must agree; the read-only check in Conditional Access linkage compares them.

Prerequisites

Security Administrator to change cross-tenant access settings;²⁵ Global Reader or Policy.Read.All to read them. The partner register current. For the tenant restrictions test, a managed Windows device with tenant restrictions v2 signalled, and a test account in a tenant that isn’t on the allowlist.

Pilot

Change the outbound default only after a month’s read of the cross-tenant access activity workbook, which shows which external tenants agency users reach;²⁶ each legitimate one gets its entry first. Then change it in a test tenant before production.

Report-only or audit phase

Cross-tenant access settings have no report-only mode. The workbook read in the pilot is the audit phase, and for tenant restrictions v2 the proxy or device rollout is phased, one proxy or one group of users at a time, as Learn’s migration guidance advises.²⁷

Enforcement

Inbound default first (partners already have entries), then outbound, then the tenant restrictions v2 default, each as its own change.

Rollback

Restore the previous default from the exported JSON (below) with Update-MgPolicyCrossTenantAccessPolicyDefault; for one partner, add or correct its entry rather than reopening the default.

Exclusions

None in the defaults. A business need is met by an organization-specific entry that meets the allowlist criteria.

Telemetry

Changes to these settings are audited under CrossTenantAccessSettings;²⁸ cross-tenant sign-ins appear in the sign-in logs of both tenants, and a service principal blocked by tenant restrictions v2 is logged only in the tenant it tried to reach.²⁹

Evidence

Read and keep the defaults and the organization-specific entries. Read-only:

# READ-ONLY. Export cross-tenant access defaults and partner entries.
Connect-MgGraph -Scopes 'Policy.Read.All' -NoWelcome
$OutDir = '.\evidence\xtap'          # CONFIGURE: this period's evidence folder
New-Item -ItemType Directory -Force -Path $OutDir | Out-Null

$Default = Get-MgPolicyCrossTenantAccessPolicyDefault
$Default | ConvertTo-Json -Depth 10 | Set-Content (Join-Path $OutDir 'default.json')
[pscustomobject]@{
    B2BCollabInboundUsers   = $Default.B2BCollaborationInbound.UsersAndGroups.AccessType
    B2BCollabInboundApps    = $Default.B2BCollaborationInbound.Applications.AccessType
    B2BCollabOutboundUsers  = $Default.B2BCollaborationOutbound.UsersAndGroups.AccessType
    DirectConnectInbound    = $Default.B2BDirectConnectInbound.UsersAndGroups.AccessType
    DirectConnectOutbound   = $Default.B2BDirectConnectOutbound.UsersAndGroups.AccessType
}

Get-MgPolicyCrossTenantAccessPolicyPartner -All |
    ConvertTo-Json -Depth 10 | Set-Content (Join-Path $OutDir 'partners.json')

Expected: blocked for every row. Each tenant ID in partners.json has a profile record, or it’s a finding.

T11, tenant restrictions v2. On a managed Windows device with tenant restrictions v2 signalled, sign in to a Microsoft 365 web app with the test account from a tenant not on the allowlist. Expected: sign-in blocked with error AADSTS5000211 (“A tenant restrictions policy added to this request by a device or network administrator does not allow access”).³⁰ Then sign in with an agency account: expected to succeed. Read the device’s tenant restrictions events, read-only:

# READ-ONLY, on the test device.
Get-WinEvent -LogName 'Microsoft-Windows-TenantRestrictions/Operational' -MaxEvents 20 |
    Select-Object TimeCreated, Id, LevelDisplayName, Message

Learn names the log as Applications and Services Logs > Microsoft > Windows > TenantRestrictions > Operational;³¹ confirm the channel name on the test device before relying on the command.

Evidence checklist

• Configuration: default.json and partners.json, with every partner tenant matched to a profile record
• Operational: CrossTenantAccessSettings audit events and the cross-tenant access activity workbook for the period
• Test: T0 to T10 for each partner, and T11 for the device baseline, with expected and observed results
• Exception: each organization-specific entry with its agreement clause, and each blocking entry with the decision behind it
• Assessor-ready artifact: the partner register and the period’s evidence package entry

Day-two ownership

The IGO owns the partner register and the allowlist; the identity engineering team owns the settings; sponsors review their partners’ guests quarterly (Chapter 09). Drift is a default changed from blocked, a partner entry with no profile record, or a partner on the list with no active package for 90 days.

Control states.

State	This page	Evidence
Designed	The default table and the allowlist criteria	The partner register and the agreements
Configured	Organization-specific entries and the defaults	partners.json and default.json
Enforced	Defaults at blocked; tenant restrictions v2 signalled on managed devices	The exports, and the device configuration assignment
Evidenced	T0 to T11	Test output files
Operated	Sponsor reviews, the monitoring section and the drift check	Review history and drift reports

A finding this page addresses is ready for closure when every applicable state has evidence; the authorizing official or assessor decides.

NoteAssessment mapping

• Microsoft Zero Trust pillar: Identity
• CISA ZTMM pillar: Identity
• Depends on: Devices (tenant restrictions v2 signalled from managed Windows devices, Book 05); Networks (the proxy or Global Secure Access path for tenant restrictions, Book 09)
• Attack chain interrupted: Initial Access through an unvetted external tenant, and Exfiltration to an external account on an agency device: default-deny admits only listed partners, and tenant restrictions stop agency devices signing in to other tenants

Conditional Access linkage

No new policy is needed. Five library policies already carry the partner list {tenant:partners}: CA009 (MFA) and CA010 (terms of use) include partner users, while CA011, CA012 and CA038 apply guest limits to everyone except partner tenants. The list must be identical in all five; a partner in one and not the others is a drift finding (Appendix A). A partner enters that list only when its access package goes live, and leaves it at partner exit. The IGO (identity governance officer) owns the list (Chapter 06).

The user type decides which of those policies apply. Conditional Access sorts external users into B2B collaboration guest users (user type Guest) and B2B collaboration member users (user type Member).³² CA009 and CA010 include both. CA011, CA012 and CA038 match only b2bCollaborationGuest and otherExternalUser, and CA016 excludes every external type. So the user type matters in four places:

• Directory permissions. A Member gets member-level default permissions; a Guest can’t enumerate users or groups.³³
• Guest-scoped policies. An external Member from a tenant missing from the list escapes CA011, CA012 and CA038.
• Persona and group rules. The Externals persona is user type Guest from partner tenants (Chapter 03); groups and reviews scoped to guests miss a Member.
• Microsoft 365. Microsoft says its services will use the member value to give different experiences over time.³⁴

Hence Guest by default, Member only by an exception record. The read-only check below proves the list is identical in all five policies and matches the tenants in cross-tenant access settings.

# READ-ONLY. Compare the partner tenant list across CA009, CA010, CA011, CA012 and CA038,
# and against the organization-specific entries in cross-tenant access settings.
Connect-MgGraph -Scopes 'Policy.Read.All'
$names = 'CA009','CA010','CA011','CA012','CA038'
$policies = (Invoke-MgGraphRequest -Method GET -Uri 'v1.0/identity/conditionalAccess/policies').value |
    Where-Object { $names -contains ($_.displayName -split '-')[0] }
$lists = foreach ($p in $policies) {
    $u = $p.conditions.users
    $t = if ($u.includeGuestsOrExternalUsers.externalTenants.members) { $u.includeGuestsOrExternalUsers.externalTenants.members }
         else { $u.excludeGuestsOrExternalUsers.externalTenants.members }
    [pscustomobject]@{ Policy = $p.displayName; State = $p.state; Tenants = (($t | Sort-Object) -join ',') }
}
$lists | Format-Table -AutoSize
$partners = (Get-MgPolicyCrossTenantAccessPolicyPartner -All).TenantId | Sort-Object
"Distinct lists across the five policies: " + ($lists.Tenants | Sort-Object -Unique).Count + " (expect 1)"
"Cross-tenant partner entries: " + ($partners -join ',')

The exception profile: cross-tenant synchronization

Cross-tenant synchronization pushes the source tenant’s internal members into the target tenant as B2B users.³⁵ For a partner, the partner is the source and the agency is the target. Allow it only when all of these hold, and record each in the exception record (design guidance):

• the partner’s people are internal members of an Entra tenant; sync can’t push a source tenant’s external users, so a partner on another identity provider can’t be synced;³⁶
• the population is too large or changes too often for per-person requests, and the reason is written down;
• the agreement covers privacy, consent and data minimization, which Microsoft leaves to the customer;³⁷
• the privacy office and records officer have seen the attribute list, and the agency business owner decides, with the sponsor named.

Part	Configured in	Profile requirement
Inbound “Allow user synchronization into this tenant”	Agency (target)	On for this partner only; group sync off38
Inbound automatic redemption	Agency (target)	On; sync requires it at both ends39
Outbound automatic redemption, job, scope, mappings	Partner (source)	Agreed in writing; the agency verifies the result in its own tenant

The agency doesn’t own the mappings, so it states them as terms and tests the outcome:

• User type. The Member (userType) mapping is a constant that defaults to Member, creating external members. The profile requires Guest.⁴⁰ An existing guest isn’t changed to Member unless Apply this mapping is set to Always.⁴¹ Ask for Guest with Always, so a later change can’t quietly promote anyone (design guidance). Test T2 checks every arriving account. A Member result is a stop condition until an exception record exists.
• Matching. Matching uses AltSecIdFromNetId([netId]) (alternativeSecurityIds), which the overview calls alternativeSecurityIdentifier; changing it or adding a matching attribute gives a schemaInvalid error.⁴² Sync can’t match an internal user in the target, and an email-invited guest who never redeemed can fail to match.⁴³⁴⁴ Test T5 finds both.
• Minimum attributes. List every mapped attribute in the record. Photos and custom security attributes can’t be synced.⁴⁵ showInAddressList defaults to True for people search;⁴⁶ set it to False unless the use case needs the partner in the address book (design guidance).
• Deletion threshold. Accidental-deletion prevention defaults to 500.⁴⁷ Set it below the expected unique population and record the value (design guidance).
• Quarantine and notice. An unhealthy job goes into quarantine, and email goes to the notification address within 24 hours.⁴⁸ Use a partner mailbox that also forwards to the agency sponsor.
• On-demand provisioning. Test one user before starting the job.⁴⁹
• Cycle. Cycles start at fixed 40-minute intervals,⁵⁰ so a partner leaver keeps access for up to a cycle plus run time. Emergency suspension (test T3) doesn’t wait for it.
• Scope. Use “Sync only assigned users and groups”. Only direct members of an assigned group are in scope; nesting doesn’t cascade.⁵¹ Record each group’s object ID, owner, direct count and the unique count across groups. A user in two groups counts once.

Sync creates the account; it doesn’t grant access. Synced partner persons still receive access through an access package assignment with the default route’s expiry and quarterly sponsor review (design guidance).

Deprovisioning follows the source. Deleting or unassigning the user, or a scope-filter change, soft-deletes the user in the target, restorable for 30 days; accountEnabled = false at the source blocks sign-in at the target.⁵² A sign-in block set in the target lasts only until the source user changes, and then sync re-enables the user.⁵³ So an agency-side suspension of a synced user also removes their access package assignment (design guidance).

A severed relationship leaves accounts behind. If the sync policy is deleted, users it created aren’t changed or removed.⁵⁴ Turning off inbound sync stops future syncs and “has no impact on existing users who have already been synchronized.”⁵⁵ To end cleanly, the partner unassigns all users while the agency keeps inbound sync on until deprovisioning finishes.⁵⁶ The agency then turns sync off and deletes whatever remains (test T10).

Cloud pair and licensing. Each synced user needs Entra ID P1 in the source tenant; the target needs no license for sync. Group sync and cross-cloud sync need Entra ID Governance or the Entra Suite in the source.⁵⁷ Only one sync instance can exist per source and target pair.⁵⁸ Cross-cloud sync between Azure commercial and Azure Government carries users only, and manager isn’t synced across clouds.⁵⁹ Manager sync isn’t supported in the US Government cloud at all.⁶⁰ Don’t let any approval rule depend on a synced manager.

Preview caution. The Entra overview read on Nov 6, 2026 lists the cross-cloud pairs as supported and doesn’t label them preview.⁶¹ A Microsoft 365 page says cross-cloud sync entered public preview in August 2025.⁶² Whether it is generally available is not verified. Confirm the support level in the portal and in current documentation before the exception is approved.

The profile record

One record per partner and use case, kept in the repository beside the configuration (Chapter 10). These are the Entra values that Book 03, Appendix D asks for.

Item	Required record
Tenant relationship	Partner tenant ID and resolved names (T0); route (default or sync exception); for sync, source and target roles; cloud pair; authorized domains; partner validation date and by whom
Cross-tenant access	Inbound scope (users, groups, applications); outbound unchanged or the reason; MFA, compliant-device and hybrid-join trust values with the agreement clause behind each; automatic redemption; Microsoft cloud setting; tenant restrictions note
Configuration	Connected organization ID and state; catalog and access package IDs; policy ID, allowedTargetScope, approvers, expiry, review settings; for sync, configuration object ID, enabled state, notification address, deletion threshold, quarantine owner and recovery steps
Assigned groups (sync only)	Group object IDs, owners, approvers, nesting rule (none), direct and unique counts, overlap, date counted
Mappings (sync only)	Matching attribute; userType = Guest and its apply setting; userPrincipalName, accountEnabled, showInAddressList, any extensions; null handling; collision rule; any Member exception record
Access governance	Access packages and application roles; review cadence and reviewer; expiry; sponsor and resource owner; last-assignment setting
Validation	Date and result of T0 to T10, with output files
Monitoring	Alert rules, log destination and retention, drift check schedule, owner

Validation tests

WarningTest tenant first

Run these in a test tenant with a test partner tenant. Commands marked WRITES change state; each says how to undo it. Every other command is read-only. Commands were checked against the Microsoft Graph PowerShell reference on Nov 6, 2026 but haven’t been run against a tenant.

Set the values once per session from the profile record. Get-PartnerUsers finds partner accounts by the B2B #EXT# user principal name; confirm that synced accounts follow the same pattern in the test tenant.

# READ-ONLY session setup. CONFIGURE the four values from the profile record.
$PartnerTenantId   = '00000000-0000-0000-0000-000000000000'
$PartnerDomain     = 'fabrikam.example'
$AccessPackageName = 'PRT-Fabrikam-CaseReview'
$TestUserEmail     = 'pp-test01@fabrikam.example'
Connect-MgGraph -Scopes 'Policy.Read.All','CrossTenantInformation.ReadBasic.All','EntitlementManagement.Read.All','User.Read.All','AuditLog.Read.All'
$ap = Get-MgEntitlementManagementAccessPackage -Filter "displayName eq '$AccessPackageName'" -ExpandProperty assignmentPolicies
function Get-PartnerUsers { Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,UserType,AccountEnabled,CreationType,ExternalUserState,CreatedDateTime |
    Where-Object { $_.UserPrincipalName -like "*_$($PartnerDomain)#EXT#@*" } }

T0, relationship. The tenant ID resolves to the partner, and the trust and redemption values match the record.

Find-MgTenantRelationshipTenantInformationByTenantId -TenantId $PartnerTenantId | Format-List TenantId, DisplayName, DefaultDomainName
$p = Get-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $PartnerTenantId
$p.InboundTrust | Format-List IsMfaAccepted, IsCompliantDeviceAccepted, IsHybridAzureAdJoinedDeviceAccepted
$p.AutomaticUserConsentSettings | Format-List InboundAllowed, OutboundAllowed
$ap.AssignmentPolicies | Format-List DisplayName, AllowedTargetScope, Expiration
Get-MgEntitlementManagementSetting | Format-List ExternalUserLifecycleAction, DurationUntilExternalUserDeletedAfterBlocked

T1, create. WRITES: creates a guest and an assignment. Undo with T4. Uses the beta module, as Learn documents for a user not yet in the directory.⁶³

Connect-MgGraph -Scopes 'EntitlementManagement.ReadWrite.All'
New-MgBetaEntitlementManagementAccessPackageAssignmentRequest -AccessPackageId $ap.Id -AssignmentPolicyId $ap.AssignmentPolicies[0].Id -TargetEmail $TestUserEmail
Get-PartnerUsers | Format-Table UserPrincipalName, UserType, AccountEnabled, CreationType, ExternalUserState, CreatedDateTime

Pass: one account, UserType = Guest. Then have the test user open https://myaccess.microsoft.com/@contoso.example and confirm the request page loads under CA009.

T2, update and user type. Every account from the partner is a Guest. For the sync exception, change the test user’s display name at the source and rerun after one cycle.

Get-PartnerUsers | Group-Object UserType | Format-Table Name, Count
Get-PartnerUsers | Where-Object UserType -ne 'Guest' | Format-Table UserPrincipalName, UserType, CreatedDateTime

Pass: no row in the second table, unless a Member exception record names that user.

T3, disable (emergency suspension). WRITES: blocks sign-in and revokes sessions. Undo in T9.

Connect-MgGraph -Scopes 'User.ReadWrite.All','User.RevokeSessions.All'
$u = Get-PartnerUsers | Where-Object UserPrincipalName -like "$($TestUserEmail.Replace('@','_'))#EXT#@*"
Update-MgUser -UserId $u.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $u.Id
Get-MgUser -UserId $u.Id -Property AccountEnabled | Format-List AccountEnabled

T4, remove. WRITES: removes the assignment. The guest should be blocked, then deleted after the configured days. Learn’s removal pattern is used as published.⁶⁴

$filter = "accessPackage/id eq '$($ap.Id)' and state eq 'Delivered' and target/objectId eq '$($u.Id)'"
$a = Get-MgEntitlementManagementAssignment -Filter $filter -ExpandProperty target -All
New-MgEntitlementManagementAssignmentRequest -BodyParameter @{ requestType = 'adminRemove'; assignment = @{ id = $a.Id } }
Get-MgUser -UserId $u.Id -Property AccountEnabled | Format-List AccountEnabled

T5, collision. Find duplicate accounts for one person and unredeemed invitations that would block a sync match.

Get-PartnerUsers | Group-Object { ($_.UserPrincipalName -split '#EXT#')[0] } | Where-Object Count -gt 1 | Format-Table Name, Count
Get-PartnerUsers | Where-Object ExternalUserState -eq 'PendingAcceptance' | Format-Table UserPrincipalName, CreatedDateTime

T6, negative access. A partner user without an assignment, and a user from a tenant not on the list, are both denied. Have each try the application, then read their sign-ins.

$deniedUserId = '00000000-0000-0000-0000-000000000000'   # CONFIGURE: the test user's object ID
Get-MgAuditLogSignIn -Filter "userId eq '$deniedUserId'" -Top 10 |
    Format-Table CreatedDateTime, AppDisplayName, ConditionalAccessStatus, @{N='Error';E={$_.Status.ErrorCode}}

Pass: a non-zero error code or a Conditional Access failure on each attempt.

T7, MFA. The test user’s sign-in shows CA009 applied and satisfied.

Get-MgAuditLogSignIn -Filter "userId eq '$($u.Id)'" -Top 5 | ForEach-Object {
    $when = $_.CreatedDateTime
    $_.AppliedConditionalAccessPolicies | Where-Object DisplayName -like 'CA009*' |
    Select-Object @{N='When';E={$when}}, DisplayName, Result }

T8, device. If the record trusts compliant devices, sign in from a partner-compliant and a non-compliant device against a device-gated application. Read the results with T7’s command, filtering on that policy’s name. If device trust is off, confirm IsCompliantDeviceAccepted is False in T0’s output.

T9, rollback. WRITES: re-enables the test user, or restores a deleted one within 30 days.

Update-MgUser -UserId $u.Id -AccountEnabled:$true
(Invoke-MgGraphRequest -Method GET -Uri 'v1.0/directory/deletedItems/microsoft.graph.user').value |
    Where-Object { $_.userPrincipalName -like "*$PartnerDomain*" } | Select-Object id, userPrincipalName, deletedDateTime
# To restore one: Restore-MgDirectoryDeletedItem -DirectoryObjectId '<id from the list>'

T10, partner exit. WRITES: run it only at the end of the relationship, or on the test partner. Remove every assignment (repeat T4’s request per assignment). For sync, wait until the partner reports its scope empty and T2 shows no enabled accounts. Then turn inbound sync off and list what is left to delete.

Connect-MgGraph -Scopes 'Policy.ReadWrite.CrossTenantAccess','User.ReadWrite.All'
Invoke-MgGraphRequest -Method PATCH -Uri "v1.0/policies/crossTenantAccessPolicy/partners/$PartnerTenantId/identitySynchronization" -Body @{ userSyncInbound = @{ isSyncAllowed = $false } }
Get-PartnerUsers | Format-Table UserPrincipalName, AccountEnabled, CreationType
# Delete each remaining account after the sponsor confirms the list: Remove-MgUser -UserId '<id>'

Then remove the partner from {tenant:partners} in the tenant map, redeploy the five policies (Appendix A), and rerun the Conditional Access check above.

Monitoring

Native sign-in and audit retention is 30 days on P1 and P2, so logs are streamed to the workspace (Chapter 09).

Signal	Where it is	What to watch
Provisioning logs (sync only)	The source tenant: the partner’s	Failed and skipped objects, quarantine, deletion-threshold holds. The agency gets them under the agreement.65
Target-side sync changes	Agency audit log, actor Microsoft.Azure.SyncFabric66	Creates, updates and deletes per cycle against the expected unique count
Entitlement management	Agency audit log, category EntitlementManagement (Chapter 09)	Requests, approvals, expiries and removals per partner package
Sign-ins and Conditional Access	Agency sign-in log; ConditionalAccessStatus, AppliedConditionalAccessPolicies67	CA009 failures, partner users from unexpected locations, denied attempts after removal
Cross-tenant settings changes	Audit category CrossTenantAccessSettings68	Any change, alerted to the IGO
Drift	The repository and the five-policy check	Partner list mismatch; any UserType other than Guest without a record; trust values that differ from the record (Chapter 07)

# READ-ONLY. Target-side sync activity over the last 7 days.
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString('yyyy-MM-ddTHH:mm:ssZ')
Get-MgAuditLogDirectoryAudit -Filter "category eq 'UserManagement' and activityDateTime ge $since" -All |
    Where-Object { $_.InitiatedBy.App.DisplayName -eq 'Microsoft.Azure.SyncFabric' } |
    Group-Object ActivityDisplayName | Format-Table Name, Count

The alerts, as design guidance: a partner account with UserType Member and no record (High); a sync cycle that deletes more than the record’s daily expectation (High); a partner list mismatch across the five policies (High); a cross-tenant settings change outside a pull request (Medium).

Tenant strategy: multitenant organizations and Tenant Governance

Everything above is about tenants the agency doesn’t own. An agency can also own more than one tenant: a component’s or subagency’s tenant, a tenant inherited in a reorganization or transfer of function, a nonproduction tenant for testing tenant-wide changes, or an isolated tenant for a critical system. Some tenants exist that nobody approved, created by staff for a trial or a proof of concept. This section sets the program’s tenant strategy and the Entra features that carry it.

How many tenants

Microsoft’s tenant estate guidance names five logical tenant roles: the primary production tenant, collaborating production tenants, isolated tenants for critical production systems, isolated tenants for business partner access, and nonproduction tenants. Its rule is to operate as few tenants as security, compliance and operational requirements allow, because every additional tenant adds administration, its own account lifecycle and attack surface, and splitting people who still work together across tenants degrades collaboration and feature support.⁶⁹ Where several tenants source identities from the same Active Directory forest, the shared source can undermine the isolation the extra tenant was meant to give.⁷⁰

The program’s position, as design guidance:

• One primary production tenant per Microsoft cloud. Each additional tenant needs a tenant record naming its Learn pattern, the requirement that outweighs the overhead, its owner, its administration pattern (below) and its exit.
• The agency’s own people are not partners. People homed in a tenant the agency owns are its workforce, not External Partner Persons, so the sync exception above doesn’t govern them. Cross-tenant synchronization is the intended tool within an organization;⁷¹ whether they arrive as Member or Guest is a tenant-strategy decision recorded in the tenant record, not a partner exception record.
• An extra tenant for partners is a design choice, not a default. Learn describes an isolated partner tenant (sometimes called an extranet tenant) as a valid pattern.⁷² The default route in this appendix keeps partners in the primary tenant behind access packages; a separate partner tenant is a tenant record with its own reason.

Three features, three jobs

Feature	What it does	Where the program uses it
Cross-tenant access settings and cross-tenant synchronization	Per-pair inbound, outbound and trust settings; one-way provisioning of B2B users between tenants7374	Every tenant pair, owned or partner (the sections above)
Multitenant organization	A tenant group that draws a boundary around the tenants the organization owns, marks external members from inside it as in-organization, and improves Teams and Viva Engage collaboration across them75	Agency-owned production tenants whose people work together in Microsoft 365; never partners
Tenant Governance (preview)	Discovery of related tenants, directional governance relationships with cross-tenant delegated administration, configuration monitoring, and governed creation of new tenants7677	Finding every tenant connected to the agency’s, and administering the ones it owns

Microsoft calls Tenant Governance and the multitenant organization complementary: Tenant Governance is for discovery, cross-tenant administration and configuration monitoring, the multitenant organization for end-user collaboration in Microsoft 365, and the two tenant lists stay independent of each other.⁷⁸

Multitenant organization and its templates

One tenant creates the multitenant organization and becomes its owner; it adds other tenants as pending, and each becomes active only when its own administrator joins, which can take up to two hours to process. Any member can leave at any time. A tenant can belong to only one multitenant organization; there can be up to 100 active tenants; a multitenant organization isn’t allowed between a Cloud Solution Provider and its customers. It needs Entra ID P1: one license per employee per multitenant organization, and at least one in each tenant.⁷⁹

Joining doesn’t bypass cross-tenant access settings. Each pair of tenants needs settings in both directions. When a tenant joins, any missing pair settings are generated unconfigured, which means they pass through each tenant’s defaults. The optional policy templates pre-set trust (MFA, compliant and hybrid-joined device claims), B2B collaboration and direct connect, automatic redemption and inbound user sync for every pair at join time. A template value of null leaves the pair’s value alone; a defined value overwrites it. templateApplicationLevel chooses whether the template touches new partners, existing partners, both or neither. Forming the multitenant organization in the Microsoft 365 admin center sets automatic redemption inbound and outbound and inbound user sync to true. There’s no template for leaving: when a tenant leaves, every remaining tenant’s administrator re-examines that pair by hand.⁸⁰

Microsoft’s limitations page adds what matters for planning. Teams collaboration assumes reciprocally provisioned B2B members. Cross-tenant synchronization makes new users members by default but leaves existing guests as guests unless the mapping is set to apply always. Contact objects that collide with provisioned users aren’t converted. Purview and Intune don’t yet support multitenant organization capabilities, and resetting redemption for a B2B user is disabled inside one.⁸¹

The program’s rules, as design guidance:

1. Agency-owned tenants only. A partner tenant never joins the agency’s multitenant organization, so in-organization external members are always the agency’s own people.
2. Templates are reviewed before the first join. Because a configured template overwrites every pair’s settings when a tenant joins, the template values sit in the repository with the cross-tenant settings (Chapter 10), and templateApplicationLevel is newPartners unless the tenant record says otherwise.
3. Members get member policies. In-organization members are matched by member-scoped Conditional Access, not by the guest policies CA011, CA012 and CA038. Test with a pilot user from each tenant that the expected policies apply (the sign-in log’s AppliedConditionalAccessPolicies) before Teams collaboration is announced.
4. Leaving is a change. A tenant leaving is a pull request that resets its pair settings in every remaining tenant.

# READ-ONLY. The multitenant organization, its tenants, and the two templates.
Connect-MgGraph -Scopes 'MultiTenantOrganization.Read.All','Policy.Read.All'
Get-MgTenantRelationshipMultiTenantOrganization | Format-List DisplayName, State, CreatedDateTime
(Invoke-MgGraphRequest -Method GET -Uri 'v1.0/tenantRelationships/multiTenantOrganization/tenants').value |
    ForEach-Object { [pscustomobject]@{ TenantId = $_.tenantId; Name = $_.displayName; Role = $_.role; State = $_.state } } |
    Format-Table -AutoSize
Get-MgPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationPartnerConfiguration | Format-List
Get-MgPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationIdentitySynchronization | Format-List

Learn’s cmdlet page lists MultiTenantOrganization.ReadWrite.All as the least-privileged permission for reading the tenant list. If the read-only scope is refused, ask the IGO before consenting to the write scope.⁸² The template reads need Policy.Read.All and Security Reader or Global Reader.⁸³

Tenant Governance: finding tenants and administering them

Tenant Governance is in preview.⁸⁴ Its four parts map to the program’s tenant strategy:

• Related tenants (discovery). Once a Tenant Governance Administrator or Global Administrator turns it on, Entra surfaces tenants connected to the agency’s by B2B collaboration, multitenant applications and shared billing accounts, with order-of-magnitude activity metrics. Turning it on can’t be undone. A related tenant isn’t proof of ownership: it may be a partner, a SaaS provider, a Microsoft-managed tenant, or an unsanctioned tenant a member of staff created.⁸⁵⁸⁶
• Governance relationships. A directional relationship in which a governing tenant governs a governed tenant, set up by a three-step handshake (invitation, request with a governance policy template, acceptance). One tenant can govern many, many can govern one, but a tenant can’t be both governing and governed. The governed tenant can always end the relationship.⁸⁷⁸⁸
• Cross-tenant delegated administration. The governance policy template maps Entra built-in roles to security groups in the governing tenant; the governed tenant gets group proxies with those roles (granular delegated admin privileges, GDAP), so administrators use their home accounts and no local or B2B admin accounts are needed. Azure and Defender roles are separate assignments the governed tenant makes afterwards. The governed tenant sees governing administrators in its own sign-in and audit logs. PIM for Groups in the governing tenant is the supported way to make those memberships just in time.⁸⁹⁹⁰ A Tenant Governance relationship can’t coexist with a Partner Center GDAP relationship between the same two tenants.⁹¹
• Configuration management and secure tenant creation. Monitors compare a tenant’s configuration with a JSON baseline every six hours, and new add-on tenants can be created already governed.⁹² The program’s drift baseline already uses configuration management (Chapter 10).

Learn’s tenant estate guidance compares three ways to administer several tenants: cross-tenant delegated administration, B2B admin accounts, and local admin accounts in each tenant. It notes that the target tenant’s Conditional Access and audit logs apply in every case.⁹³ The program’s choice, as design guidance: delegated administration through a governance relationship for agency-owned production and nonproduction tenants, with the governing groups managed by PIM for Groups under the tier model (Chapter 04); local accounts only for a tenant whose record requires isolation from every other tenant (an isolated critical-system tenant); B2B admin accounts not used.

Unsanctioned tenants. Discovery turns up tenants nobody approved. The IGO reviews each related tenant that isn’t a known partner or Microsoft-managed: a tenant the agency owns is brought under a governance relationship or retired; one whose administrators won’t accept governance is quarantined. Microsoft’s FAQ points to the quarantine procedure in that case, which blocks the other tenant’s users and applications from agency resources.⁹⁴ Chapter 09 carries the quarantine steps.

# READ-ONLY (beta, preview). Related tenants with their discovery metrics.
GET https://graph.microsoft.com/beta/directory/tenantGovernance/relatedTenants

The request is Learn’s first step for investigating related tenants.⁹⁵ Run it in Graph Explorer or through Invoke-MgGraphRequest as a Tenant Governance reader, and keep the output with the tenant records.

Tenant restrictions v2: the outbound edge

The partner route controls who comes in. Tenant restrictions control which external tenants agency users can sign in to from agency devices and networks; they’re configured in cross-tenant access settings but operate separately from inbound and outbound settings.⁹⁶ Version 1 was a proxy header allowlist (Restrict-Access-To-Tenants) that protected only the authentication plane. Version 2 is a cloud policy: a default policy, plus a partner policy per allowed tenant. It’s signalled by universal tenant restrictions through Global Secure Access, by a proxy header, or by Windows device management, which also gives data-plane protection on managed Windows devices.⁹⁷ Migrating means keeping the v2 default that blocks external tenants, creating a partner policy for each tenant on the v1 allowlist, and removing the v1 headers from the proxy.⁹⁸

The program sets tenant restrictions v2 as the outbound counterpart of the partner list (design guidance): default block; a partner policy for each agency-owned tenant and each partner tenant whose access package lists outbound use; and the Microsoft account tenant blocked. Signalling uses Windows device management on managed devices. Universal tenant restrictions waits on Global Secure Access, which Learn doesn’t yet support in GCC High or DoD (Chapter 07).

Government clouds

Feature	Agency tenant in GCC (Entra in Azure commercial)	Tenants in GCC High or DoD (Azure Government)
Multitenant organization	Learn conflicts: its limitations page lists “multitenant organizations in Microsoft 365 Government” and “in Azure Government” as unsupported, and in the same list says multitenant organizations are available in GCC, GCC High and DoD with same-cloud tenants only99	Same conflict; cross-cloud multitenant organizations aren’t supported100
Multitenant organization templates (Graph)	Global service101	Not available in US Government L4 or L5102
B2B collaboration across clouds	Commercial and Azure Government can collaborate once both enable each other in Microsoft cloud settings; B2B direct connect isn’t supported across clouds103104	Within Azure Government, B2B works only between tenants that both support it (tenant_region_scope USGOV)105
Tenant Governance	Not yet specified	Not yet specified
Tenant restrictions v2	Not yet specified	Not yet specified

Until Microsoft resolves the multitenant organization conflict in writing, the program doesn’t plan Teams collaboration on a multitenant organization in a government cloud. It uses the cross-tenant settings and synchronization above, and confirms the support level with Microsoft before any tenant joins.

Requirements, KSIs and evidence

Control mapping is design guidance; the book-level mapping is in Book 02, Appendix A. Each KSI listed is one whose related SP 800-53 controls include the row’s control.¹⁰⁶¹⁰⁷ KSIs are indicators for cloud service providers. The agency lines its own evidence up with them; it doesn’t report KSIs itself.

Step	SP 800-53 Rev. 5	KSI	Evidence the ISSO keeps
Partner entry, inbound scope, trust (T0)	AC-3, AC-20, IA-8	KSI-IAM-ELP, KSI-IAM-APM	T0 output; the cross-tenant settings file; agreement clause for each trust value
Access package, approval, expiry	AC-2, AC-2(2), AC-6(7)	KSI-IAM-AAM, KSI-IAM-APM	Policy export; request and approval audit records; review history
Create and user type (T1, T2)	AC-2(2), AC-6	KSI-IAM-AAM, KSI-IAM-ELP	T1 and T2 output; any Member exception record
Suspension, removal, exit (T3, T4, T10)	AC-2(3), PS-4 and PS-5 equivalents for the partner	KSI-IAM-AAM, KSI-IAM-ELP	Commands run, timestamps, the post-state reads, the sponsor’s exit confirmation
Collision and negative access (T5, T6)	AC-3, IA-8	KSI-IAM-ELP, KSI-IAM-APM	T5 and T6 output with error codes
MFA and device (T7, T8)	IA-2(1), IA-8	KSI-IAM-APM	Sign-in records showing CA009 applied
Monitoring and alerts	AU-6, AC-2(4)	KSI-MLA-RVL, KSI-MLA-LET	Alert rules; weekly sync-activity summary; quarantine notices
Drift	CA-7, CM-6	KSI-MLA-EVC	Five-policy check output; drift report per run
Tenant strategy: tenant records, multitenant organization, governance relationships, tenant restrictions	AC-2, AC-6(5), AC-20, CM-8	KSI-IAM-ELP	Tenant records; template and tenant-list reads; related-tenant review with the IGO’s decision per tenant; governance policy templates and PIM for Groups settings; tenant restrictions v2 policy export

Privacy and records obligations follow Book 03, Chapter 15: the attribute list goes to the privacy office, and system access records sit under GRS 3.2 (Chapter 09). The retention of agreements and review records is the records officer’s decision; no period is set here.

Government-cloud availability check

Read on Nov 6, 2026. Recheck before each new partner.

Feature	Agency tenant (GCC, Entra in Azure commercial)	Partner in GCC High or DoD (Azure Government)
Entitlement management, connected organizations	Available; Entra ID Governance is offered in GCC, GCC High and DoD108	Connected organization of type “Entra ID, in another cloud”109
B2B collaboration	Available	Both tenants enable each other’s cloud in Microsoft cloud settings; B2B direct connect isn’t supported across clouds; the partner is added by tenant ID, not domain, and invited by UPN110111112
Cross-tenant sync, same cloud	Users and groups (commercial to commercial)113	Not applicable: the pair is cross-cloud
Cross-tenant sync, cross-cloud	Users only; Governance or Suite license in the source; no manager114	Same; preview status not verified
Multitenant organization	See the tenant strategy: same-cloud only; Learn’s statements conflict115	Cross-cloud multitenant organization not supported116
Tenant Governance (preview)	Not yet specified	Not yet specified

Workload support differs from directory support. Microsoft notes that Teams doesn’t support external members across clouds.¹¹⁷ Check each application’s government service description before promising a partner access to it.

TipContinue the book

← Previous: Appendix B — PIM Role Settings Reference · Book index · Next: Appendix D — Phishing-Resistant Authentication Runbooks →

---

1. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

2. Microsoft Learn, “Manage connected organizations in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-organization (accessed Nov 6, 2026).

3. Microsoft Learn, “Manage connected organizations in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-organization (accessed Nov 6, 2026).

4. Microsoft Learn, “Manage connected organizations in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-organization (accessed Nov 6, 2026).

5. Microsoft Learn, “accessPackageAssignmentPolicy resource type” (Microsoft Graph v1.0), https://learn.microsoft.com/graph/api/resources/accesspackageassignmentpolicy?view=graph-rest-1.0 (accessed Nov 6, 2026).

6. Microsoft Learn, “Govern access for external users in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-external-users (accessed Nov 6, 2026).

7. Microsoft Learn, “Govern access for external users in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-external-users (accessed Nov 6, 2026).

8. Microsoft Learn, “entitlementManagementSettings resource type” (Microsoft Graph v1.0), https://learn.microsoft.com/graph/api/resources/entitlementmanagementsettings?view=graph-rest-1.0 (accessed Nov 6, 2026).

9. Microsoft Learn, “Govern access for external users in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-external-users (accessed Nov 6, 2026).

10. Microsoft Learn, “Govern access for external users in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-external-users (accessed Nov 6, 2026).

11. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

12. Microsoft Learn, “Manage cross-tenant access settings for B2B collaboration,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration (accessed Nov 9, 2026).

13. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

14. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

15. Microsoft Learn, “Enable B2B collaboration across Microsoft clouds” (Microsoft cloud settings), https://learn.microsoft.com/entra/external-id/cross-cloud-settings (accessed Nov 9, 2026).

16. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

17. Microsoft Learn, “Set up tenant restrictions v2,” sections Tenant restrictions v2 overview, Compare tenant restrictions v1 and v2, and Tenant restrictions vs. inbound and outbound settings; and, read Nov 11, 2026, “Configure tenant restrictions v2 on the client side” (View tenant restrictions v2 events in Event Viewer), “Tenant restrictions v2 and service principals” (error AADSTS5000211) and “Sign-in logs,” https://learn.microsoft.com/entra/external-id/tenant-restrictions-v2 (accessed Nov 9, 2026; re-read Nov 11, 2026).

18. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

19. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

20. Microsoft Learn, “Manage cross-tenant access settings for B2B collaboration,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration (accessed Nov 9, 2026).

21. Microsoft Learn, “Manage cross-tenant access settings for B2B collaboration,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration (accessed Nov 9, 2026).

22. Microsoft Learn, “Manage cross-tenant access settings for B2B collaboration,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration (accessed Nov 9, 2026).

23. Microsoft Learn, “crossTenantAccessPolicyConfigurationDefault resource type” (Microsoft Graph v1.0; automaticUserConsentSettings inbound and outbound are always false and can’t be updated in the default configuration), https://learn.microsoft.com/graph/api/resources/crosstenantaccesspolicyconfigurationdefault?view=graph-rest-1.0 (accessed Nov 11, 2026).

24. Microsoft Learn, “Manage cross-tenant access settings for B2B collaboration,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration (accessed Nov 9, 2026).

25. Microsoft Learn, “Manage cross-tenant access settings for B2B collaboration,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration (accessed Nov 9, 2026).

26. Microsoft Learn, “Plan a tenant restrictions v1 migration to tenant restrictions v2,” sections “Enable tenant restrictions v2” (phased rollout, one proxy at a time or by groups of users, with a rollback plan) and “Monitor” (the cross-tenant access activity workbook), https://learn.microsoft.com/entra/external-id/tenant-restrictions-migration (accessed Nov 11, 2026).

27. Microsoft Learn, “Plan a tenant restrictions v1 migration to tenant restrictions v2,” sections “Enable tenant restrictions v2” (phased rollout, one proxy at a time or by groups of users, with a rollback plan) and “Monitor” (the cross-tenant access activity workbook), https://learn.microsoft.com/entra/external-id/tenant-restrictions-migration (accessed Nov 11, 2026).

28. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

29. Microsoft Learn, “Set up tenant restrictions v2,” sections Tenant restrictions v2 overview, Compare tenant restrictions v1 and v2, and Tenant restrictions vs. inbound and outbound settings; and, read Nov 11, 2026, “Configure tenant restrictions v2 on the client side” (View tenant restrictions v2 events in Event Viewer), “Tenant restrictions v2 and service principals” (error AADSTS5000211) and “Sign-in logs,” https://learn.microsoft.com/entra/external-id/tenant-restrictions-v2 (accessed Nov 9, 2026; re-read Nov 11, 2026).

30. Microsoft Learn, “Set up tenant restrictions v2,” sections Tenant restrictions v2 overview, Compare tenant restrictions v1 and v2, and Tenant restrictions vs. inbound and outbound settings; and, read Nov 11, 2026, “Configure tenant restrictions v2 on the client side” (View tenant restrictions v2 events in Event Viewer), “Tenant restrictions v2 and service principals” (error AADSTS5000211) and “Sign-in logs,” https://learn.microsoft.com/entra/external-id/tenant-restrictions-v2 (accessed Nov 9, 2026; re-read Nov 11, 2026).

31. Microsoft Learn, “Set up tenant restrictions v2,” sections Tenant restrictions v2 overview, Compare tenant restrictions v1 and v2, and Tenant restrictions vs. inbound and outbound settings; and, read Nov 11, 2026, “Configure tenant restrictions v2 on the client side” (View tenant restrictions v2 events in Event Viewer), “Tenant restrictions v2 and service principals” (error AADSTS5000211) and “Sign-in logs,” https://learn.microsoft.com/entra/external-id/tenant-restrictions-v2 (accessed Nov 9, 2026; re-read Nov 11, 2026).

32. Microsoft Learn, “Authentication and Conditional Access for External ID,” section “Conditional Access for external users,” https://learn.microsoft.com/entra/external-id/authentication-conditional-access (accessed Nov 6, 2026).

33. Microsoft Learn, “Understand and manage the properties of B2B guest users,” and “Multitenant user management introduction,” https://learn.microsoft.com/entra/external-id/user-properties, https://learn.microsoft.com/entra/architecture/multi-tenant-user-management-introduction (accessed Nov 6, 2026).

34. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

35. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

36. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

37. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

38. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

39. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

40. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

41. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

42. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

43. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

44. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

45. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

46. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

47. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

48. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

49. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

50. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

51. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

52. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

53. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

54. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

55. Microsoft Learn, “Update crossTenantIdentitySyncPolicyPartner” (Microsoft Graph v1.0), https://learn.microsoft.com/graph/api/crosstenantidentitysyncpolicypartner-update?view=graph-rest-1.0 (accessed Nov 6, 2026).

56. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

57. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

58. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

59. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

60. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

61. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

62. Microsoft Learn, “Cross-cloud collaboration with Microsoft 365,” section “CCB2B – Entra ID level,” https://learn.microsoft.com/microsoft-365/enterprise/cross-cloud-collaboration (accessed Nov 6, 2026).

63. Microsoft Learn, “View, add, and remove assignments for an access package in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-assignments (accessed Nov 6, 2026).

64. Microsoft Learn, “View, add, and remove assignments for an access package in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-assignments (accessed Nov 6, 2026).

65. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

66. Microsoft Learn, “Configure cross-tenant synchronization” (ms.date 2026-11-02), Steps 7, 9, 10, 11, 12 and 13 and Troubleshooting, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-configure (accessed Nov 6, 2026).

67. Microsoft Learn, “signIn resource type” (Microsoft Graph v1.0), https://learn.microsoft.com/graph/api/resources/signin?view=graph-rest-1.0 (accessed Nov 6, 2026).

68. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

69. Microsoft Learn, “Microsoft Entra tenant estate guidance introduction,” sections Tenant architecture patterns, When to integrate an app or workload with an existing tenant, Tenant lifecycle governance and Multitenant administration patterns, https://learn.microsoft.com/entra/architecture/tenant-estate-guide; “Microsoft Entra tenant estate guidance for business partner access,” https://learn.microsoft.com/entra/architecture/tenant-estate-business-partner (accessed Nov 9, 2026).

70. Microsoft Learn, “Microsoft Entra tenant estate guidance for hybrid identity and isolation,” https://learn.microsoft.com/entra/architecture/tenant-estate-hybrid-identity (accessed Nov 9, 2026).

71. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

72. Microsoft Learn, “Microsoft Entra tenant estate guidance introduction,” sections Tenant architecture patterns, When to integrate an app or workload with an existing tenant, Tenant lifecycle governance and Multitenant administration patterns, https://learn.microsoft.com/entra/architecture/tenant-estate-guide; “Microsoft Entra tenant estate guidance for business partner access,” https://learn.microsoft.com/entra/architecture/tenant-estate-business-partner (accessed Nov 9, 2026).

73. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

74. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

75. Microsoft Learn, “What is a multitenant organization in Microsoft Entra ID?,” sections How does a multitenant organization work, Tenant role and state, Constraints, Limits and License requirements, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-overview (accessed Nov 9, 2026).

76. Microsoft Learn, “What is Microsoft Entra Tenant Governance?,” https://learn.microsoft.com/entra/id-governance/tenant-governance/overview (accessed Nov 9, 2026).

77. Microsoft Learn, “Investigate related tenant signals by using Microsoft Graph (preview)” (states that Tenant Governance is in preview), https://learn.microsoft.com/entra/id-governance/tenant-governance/how-to-investigate-related-tenants-api (accessed Nov 9, 2026).

78. Microsoft Learn, “Frequently asked questions for Microsoft Entra Tenant Governance,” https://learn.microsoft.com/entra/id-governance/tenant-governance/faq (accessed Nov 9, 2026).

79. Microsoft Learn, “What is a multitenant organization in Microsoft Entra ID?,” sections How does a multitenant organization work, Tenant role and state, Constraints, Limits and License requirements, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-overview (accessed Nov 9, 2026).

80. Microsoft Learn, “Multitenant organization optional policy templates,” https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-templates; “Configure multitenant organization policy templates using the Microsoft Graph API,” https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-configure-templates (accessed Nov 9, 2026).

81. Microsoft Learn, “Limitations in multitenant organizations,” sections Scope, Cross-tenant synchronization in Microsoft Entra admin center, Microsoft apps, and B2B users or B2B members, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-known-issues (accessed Nov 9, 2026).

82. Microsoft Learn, “Configure a multitenant organization using PowerShell or Microsoft Graph API,” https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-configure-graph; “Get-MgTenantRelationshipMultiTenantOrganizationTenant” and “Get-MgTenantRelationshipMultiTenantOrganization” (Microsoft Graph PowerShell), https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/get-mgtenantrelationshipmultitenantorganizationtenant, https://learn.microsoft.com/powershell/module/microsoft.graph.identity.signins/get-mgtenantrelationshipmultitenantorganization (accessed Nov 9, 2026).

83. Microsoft Learn, “Get multiTenantOrganizationPartnerConfigurationTemplate” (Microsoft Graph v1.0; national cloud table and permissions), https://learn.microsoft.com/graph/api/multitenantorganizationpartnerconfigurationtemplate-get?view=graph-rest-1.0 (accessed Nov 9, 2026).

84. Microsoft Learn, “Investigate related tenant signals by using Microsoft Graph (preview)” (states that Tenant Governance is in preview), https://learn.microsoft.com/entra/id-governance/tenant-governance/how-to-investigate-related-tenants-api (accessed Nov 9, 2026).

85. Microsoft Learn, “Related tenants in Tenant Governance,” https://learn.microsoft.com/entra/id-governance/tenant-governance/related-tenants (accessed Nov 9, 2026).

86. Microsoft Learn, “Enable tenant discovery,” https://learn.microsoft.com/entra/id-governance/tenant-governance/how-to-enable-tenant-discovery (accessed Nov 9, 2026).

87. Microsoft Learn, “Governance relationships,” https://learn.microsoft.com/entra/id-governance/tenant-governance/governance-relationships (accessed Nov 9, 2026).

88. Microsoft Learn, “Frequently asked questions for Microsoft Entra Tenant Governance,” https://learn.microsoft.com/entra/id-governance/tenant-governance/faq (accessed Nov 9, 2026).

89. Microsoft Learn, “Cross-tenant delegated administration,” https://learn.microsoft.com/entra/id-governance/tenant-governance/cross-tenant-delegated-administration (accessed Nov 9, 2026).

90. Microsoft Learn, “Frequently asked questions for Microsoft Entra Tenant Governance,” https://learn.microsoft.com/entra/id-governance/tenant-governance/faq (accessed Nov 9, 2026).

91. Microsoft Learn, “Frequently asked questions for Microsoft Entra Tenant Governance,” https://learn.microsoft.com/entra/id-governance/tenant-governance/faq (accessed Nov 9, 2026).

92. Microsoft Learn, “What is Microsoft Entra Tenant Governance?,” https://learn.microsoft.com/entra/id-governance/tenant-governance/overview (accessed Nov 9, 2026).

93. Microsoft Learn, “Microsoft Entra tenant estate guidance introduction,” sections Tenant architecture patterns, When to integrate an app or workload with an existing tenant, Tenant lifecycle governance and Multitenant administration patterns, https://learn.microsoft.com/entra/architecture/tenant-estate-guide; “Microsoft Entra tenant estate guidance for business partner access,” https://learn.microsoft.com/entra/architecture/tenant-estate-business-partner (accessed Nov 9, 2026).

94. Microsoft Learn, “Frequently asked questions for Microsoft Entra Tenant Governance,” https://learn.microsoft.com/entra/id-governance/tenant-governance/faq (accessed Nov 9, 2026).

95. Microsoft Learn, “Investigate related tenant signals by using Microsoft Graph (preview)” (states that Tenant Governance is in preview), https://learn.microsoft.com/entra/id-governance/tenant-governance/how-to-investigate-related-tenants-api (accessed Nov 9, 2026).

96. Microsoft Learn, “Set up tenant restrictions v2,” sections Tenant restrictions v2 overview, Compare tenant restrictions v1 and v2, and Tenant restrictions vs. inbound and outbound settings; and, read Nov 11, 2026, “Configure tenant restrictions v2 on the client side” (View tenant restrictions v2 events in Event Viewer), “Tenant restrictions v2 and service principals” (error AADSTS5000211) and “Sign-in logs,” https://learn.microsoft.com/entra/external-id/tenant-restrictions-v2 (accessed Nov 9, 2026; re-read Nov 11, 2026).

97. Microsoft Learn, “Set up tenant restrictions v2,” sections Tenant restrictions v2 overview, Compare tenant restrictions v1 and v2, and Tenant restrictions vs. inbound and outbound settings; and, read Nov 11, 2026, “Configure tenant restrictions v2 on the client side” (View tenant restrictions v2 events in Event Viewer), “Tenant restrictions v2 and service principals” (error AADSTS5000211) and “Sign-in logs,” https://learn.microsoft.com/entra/external-id/tenant-restrictions-v2 (accessed Nov 9, 2026; re-read Nov 11, 2026).

98. Microsoft Learn, “Set up tenant restrictions v2,” section Migrate tenant restrictions v1 policies to v2 on the proxy, https://learn.microsoft.com/entra/external-id/tenant-restrictions-v2; “Plan a Tenant Restrictions v1 Migration to Tenant Restrictions v2,” https://learn.microsoft.com/entra/external-id/tenant-restrictions-migration (accessed Nov 9, 2026).

99. Microsoft Learn, “Limitations in multitenant organizations,” sections Scope, Cross-tenant synchronization in Microsoft Entra admin center, Microsoft apps, and B2B users or B2B members, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-known-issues (accessed Nov 9, 2026).

100. Microsoft Learn, “Limitations in multitenant organizations,” sections Scope, Cross-tenant synchronization in Microsoft Entra admin center, Microsoft apps, and B2B users or B2B members, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-known-issues (accessed Nov 9, 2026).

101. Microsoft Learn, “Get multiTenantOrganizationPartnerConfigurationTemplate” (Microsoft Graph v1.0; national cloud table and permissions), https://learn.microsoft.com/graph/api/multitenantorganizationpartnerconfigurationtemplate-get?view=graph-rest-1.0 (accessed Nov 9, 2026).

102. Microsoft Learn, “Get multiTenantOrganizationPartnerConfigurationTemplate” (Microsoft Graph v1.0; national cloud table and permissions), https://learn.microsoft.com/graph/api/multitenantorganizationpartnerconfigurationtemplate-get?view=graph-rest-1.0 (accessed Nov 9, 2026).

103. Microsoft Learn, “Enable B2B collaboration across Microsoft clouds” (Microsoft cloud settings), https://learn.microsoft.com/entra/external-id/cross-cloud-settings (accessed Nov 9, 2026).

104. Microsoft Learn, “Microsoft Entra B2B in government and national clouds,” https://learn.microsoft.com/entra/external-id/b2b-government-national-clouds (accessed Nov 9, 2026).

105. Microsoft Learn, “Microsoft Entra B2B in government and national clouds,” https://learn.microsoft.com/entra/external-id/b2b-government-national-clouds (accessed Nov 9, 2026).

106. FedRAMP, FedRAMP Consolidated Rules for 2026, Key Security Indicators, “Identity and Access Management” (KSI-IAM-AAM, KSI-IAM-APM, KSI-IAM-ELP), https://www.fedramp.gov/2026/providers/20x/key-security-indicators/identity-and-access-management/ (accessed Nov 6, 2026).

107. FedRAMP, FedRAMP Consolidated Rules for 2026, Key Security Indicators, “Monitoring, Logging, and Auditing” (KSI-MLA-EVC, KSI-MLA-LET, KSI-MLA-RVL), https://www.fedramp.gov/2026/providers/20x/key-security-indicators/monitoring-logging-and-auditing/ (accessed Nov 6, 2026).

108. Microsoft Learn, “Microsoft Entra feature availability,” section “Other Microsoft Entra products,” https://learn.microsoft.com/entra/identity/authentication/feature-availability (accessed Nov 6, 2026).

109. Microsoft Learn, “Manage connected organizations in entitlement management,” https://learn.microsoft.com/entra/id-governance/entitlement-management-organization (accessed Nov 6, 2026).

110. Microsoft Learn, “Overview: Cross-tenant access with Microsoft Entra External ID,” https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview (accessed Nov 6, 2026).

111. Microsoft Learn, “Enable B2B collaboration across Microsoft clouds” (Microsoft cloud settings), https://learn.microsoft.com/entra/external-id/cross-cloud-settings (accessed Nov 9, 2026).

112. Microsoft Learn, “Microsoft Entra B2B in government and national clouds,” https://learn.microsoft.com/entra/external-id/b2b-government-national-clouds (accessed Nov 9, 2026).

113. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

114. Microsoft Learn, “What is cross-tenant synchronization?” (ms.date 2026-11-02), sections Who should use, Properties, Automatic redemption setting, License requirements and Frequently asked questions, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview (accessed Nov 6, 2026).

115. Microsoft Learn, “Limitations in multitenant organizations,” sections Scope, Cross-tenant synchronization in Microsoft Entra admin center, Microsoft apps, and B2B users or B2B members, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-known-issues (accessed Nov 9, 2026).

116. Microsoft Learn, “Limitations in multitenant organizations,” sections Scope, Cross-tenant synchronization in Microsoft Entra admin center, Microsoft apps, and B2B users or B2B members, https://learn.microsoft.com/entra/identity/multi-tenant-organizations/multi-tenant-organization-known-issues (accessed Nov 9, 2026).

117. Microsoft Learn, “Cross-cloud collaboration with Microsoft 365,” section “CCB2B – Entra ID level,” https://learn.microsoft.com/microsoft-365/enterprise/cross-cloud-collaboration (accessed Nov 6, 2026).