Guest User Policies and External Collaboration

Azure AD B2B (Business-to-Business) collaboration allows you to securely share your organization's applications and services with guest users from any other organization. A guest user is an external identity that can access resources in your tenant. They are represented as a user object in Azure AD, but with a UserType of 'Guest'. The guest user authenticates with their home organization or with a one-time passcode (for users without Azure AD or Microsoft Account).

Creating local accounts for external users is a security risk—you have to manage their passwords, and if their employment ends at their company, you might not know. B2B delegates authentication to the external identity provider, reducing your credential management burden. Also, B2B users can be governed with Azure AD features like Conditional Access, access reviews, and entitlement management, just like internal users.

By default, guest users have limited permissions in the directory. They can read their own profile, but cannot browse other users or groups. They can be granted access to applications and groups. The default guest user permissions can be changed in External Identities > External collaboration settings. The two main settings are: - Guest user access restrictions: Choose between 'Guest users have the same access as members' (not recommended), 'Guest users have limited access to properties and memberships of directory objects' (default), or 'Guest user access is restricted to properties and memberships of their own directory objects' (most restrictive). - Guest invite settings: Who can invite guests. Options: 'Anyone in the organization can invite guest users including guests and admins' (default), 'Member users and users assigned to specific admin roles can invite guest users including guests with member role', or 'Only users assigned to specific admin roles can invite guest users'.

Conditional Access policies can apply to guest users. You can target the policy to 'Guest or external users' identity. Common scenarios:

Important Exam Point: When you apply a Conditional Access policy to guest users, the policy is evaluated at the resource tenant, not the home tenant. The guest user must satisfy the policy in the resource tenant. If MFA is required, the guest user must register for MFA in the resource tenant (they can use their own MFA method if they have one, but it's easier to register again).

Entitlement management allows you to create access packages that bundle resources (groups, apps, SharePoint sites) and grant time-limited access to internal and external users. For external users, you can define: - Access package with a policy that allows users not yet in your directory to request access. This triggers an invitation and creates a guest user. - Access review: After a set period, the guest user's access must be reviewed by a designated reviewer (e.g., the manager who sponsored them). If the review is denied, the guest user loses access and their account can be deleted (via the 'Remove guest user from directory' option). - Lifecycle: You can set an expiration for the access package assignment (e.g., 30 days). After expiration, the guest user's access is removed, and the account can be automatically deleted after a grace period (default 30 days).

Access reviews are a key governance tool. You can create a review of all guest users or guest access to specific groups/apps. The review can be periodic (e.g., monthly) or one-time. The reviewer can be the guest themselves (self-review) or a designated manager. At the end of the review, you can automatically remove access or delete the guest user if not approved.

You can set a guest user expiration policy via the Azure portal: External Identities > External collaboration settings > Guest user expiration. You can set a time period (days) after which guest users who have not logged in will be automatically removed. This is a cleanup mechanism.

Cross-tenant access settings allow you to control inbound and outbound B2B collaboration. You can configure: - Inbound settings: Which external tenants can invite your users as guests? Default is all tenants allowed. You can block specific tenants or allow only specific tenants. - Outbound settings: Which external tenants your users can be invited to? Default is all tenants allowed. - Trust settings: You can trust MFA, compliant devices, and hybrid Azure AD join claims from external tenants. This is important for Conditional Access—if you trust the external tenant's MFA, your policy can skip requiring MFA again.

Exam Tip: Cross-tenant access settings are new (as of 2022) and often tested. Remember that trust settings are one-way: you can trust claims from an external tenant, but that external tenant must also trust your claims for mutual trust.

You can monitor guest user sign-ins in Azure AD sign-in logs. Look for the 'Guest' user type. Failed sign-ins due to Conditional Access or policy violations are logged.

Invite a guest user using Microsoft Graph:

POST https://graph.microsoft.com/v1.0/invitations
Content-type: application/json
{
  "invitedUserEmailAddress": "user@contoso.com",
  "inviteRedirectUrl": "https://myapp.contoso.com",
  "sendInvitationMessage": true
}

Get guest users using Azure AD PowerShell:

Get-AzureADUser -Filter "UserType eq 'Guest'"

Set guest user invitation lifetime policy:

Set-AzureADPolicy -Id <policyId> -DisplayName "InvitationLifetimePolicy" -Definition @('{"InvitationLifetimeInDays":30}')

Scenario 1: Consulting Firm Access to Project Resources A large enterprise hires a consulting firm for a 6-month project. The consultants need access to a specific SharePoint site, a custom app, and a group for collaboration. The enterprise uses Azure AD B2B to invite the consultants as guest users. They create an access package containing the SharePoint site and the app, with a policy that requires approval from the project manager and expires in 6 months. They also set up an access review every month where the project manager confirms the consultant still needs access. Cross-tenant access settings are configured to block all tenants except the consulting firm's tenant, and they trust the consulting firm's MFA claims so consultants don't need to re-register MFA. This setup provides secure, time-limited access with governance.

Scenario 2: Partner Access to Sales Portal A software company wants to give its resellers access to a sales portal. They use Azure AD B2B to invite the resellers. Because resellers may not have Azure AD, they enable the one-time passcode feature. They create a Conditional Access policy that requires MFA for all guest users (resellers must register MFA using the Microsoft Authenticator app). They also set a guest user expiration policy of 90 days of inactivity to automatically clean up stale accounts. The resellers' access is reviewed quarterly by the partner manager. This ensures that only active partners have access and that MFA protects against credential theft.

Common Pitfalls: