B2B Direct Connect and Cross-Tenant Sync

B2B Direct Connect is a feature in Microsoft Entra External ID that allows users from one tenant to access resources in another tenant without being invited as guests. Instead, a mutual trust relationship is established through organizational settings. Cross-Tenant Sync is a separate feature that synchronizes user identities from one tenant to another as B2B collaboration users, enabling seamless access while maintaining user lifecycle management.

These features are designed for organizations that need to collaborate with partners or subsidiaries that have their own Azure AD tenants. They differ from B2B Collaboration (inviting guests via email) in that they require pre-configuration and mutual agreement.

B2B Direct Connect relies on cross-tenant access settings and organizational relationships. Here's the mechanism:

Cross-Tenant Sync is a more recent feature that addresses the need for user lifecycle management across tenants. It uses the Microsoft Identity Synchronization Service (MISS) to replicate user objects from a source tenant to a target tenant as B2B collaboration users.

Using Microsoft Graph PowerShell:

To configure cross-tenant access settings:

# Install module
Install-Module Microsoft.Graph.Identity.SignIns -Scope CurrentUser

# Connect
Connect-MgGraph -Scopes "Policy.ReadWrite.CrossTenantAccess"

# Create a cross-tenant access policy for a partner tenant
$params = @{
    @odata.type = "#microsoft.graph.crossTenantAccessPolicyConfigurationPartner"
    tenantId = "partner-tenant-id"
    inboundTrust = @{
        isMfaAccepted = $true
        isCompliantDeviceAccepted = $true
        isHybridAzureADJoinedDeviceAccepted = $false
    }
    b2bDirectConnectOutbound = @{
        usersAndGroups = @{
            accessType = "allowed"
            targets = @(
                @{
                    @odata.type = "#microsoft.graph.crossTenantAccessPolicyTarget"
                    targetType = "user"
                    targetId = "allUsers"
                }
            )
        }
    }
}
New-MgPolicyCrossTenantAccessPolicyPartner -BodyParameter $params

To configure Cross-Tenant Sync:

# Install module
Install-Module Microsoft.Graph.Identity.DirectoryManagement -Scope CurrentUser

# Connect
Connect-MgGraph -Scopes "CrossTenantUserProfileSharing.ReadWrite.All"

# Create a cross-tenant sync configuration (target tenant perspective)
$params = @{
    displayName = "Sync with Partner"
    sourceTenantId = "source-tenant-id"
    userSyncInbound = @{
        isSyncAllowed = $true
    }
}
New-MgPolicyCrossTenantAccessPolicyDefault -BodyParameter $params

A large financial services firm acquires a smaller fintech company. Both use Microsoft 365 with separate Azure AD tenants. The goal is to allow the fintech employees to access shared project sites in the parent tenant without creating duplicate accounts. The parent tenant configures B2B Direct Connect with trust for MFA and compliant devices. The fintech users can access Teams shared channels and SharePoint sites without being guests. Additionally, Cross-Tenant Sync is configured to replicate the fintech user directory into the parent tenant for visibility in people picker and for lifecycle management. The sync scope is limited to 500 users (the fintech workforce). This avoids the 50,000 limit and reduces noise. The main challenge is ensuring that the fintech users' home tenant MFA policies align with the parent's trust settings. Misconfiguration could lead to users being prompted for MFA twice, causing confusion.

A global manufacturing company has three subsidiaries, each with its own Azure AD tenant. They need to collaborate on a joint product launch. The corporate IT team sets up a hub-and-spoke model: the corporate tenant is the hub, and each subsidiary tenant is a spoke. B2B Direct Connect is configured between the hub and each spoke. Cross-Tenant Sync is used to sync a subset of users (e.g., project managers) from each spoke into the hub. The hub hosts shared resources like SharePoint sites and Teams channels. Performance considerations: with three spokes, the hub's cross-tenant policies must be carefully scoped to avoid overlapping or conflicting rules. The sync interval of 5 minutes is acceptable for this scenario. A common pitfall is forgetting to enable outbound access from the hub to the spokes, which would prevent hub users from initiating collaboration.

Two healthcare organizations need to share patient data for a joint research project, subject to HIPAA regulations. They use B2B Direct Connect but do NOT trust MFA from the partner tenant because each organization has its own MFA policies. Instead, each user must authenticate with their home tenant MFA and then satisfy the resource tenant's MFA requirement. This results in double MFA prompts, which is acceptable for compliance. Cross-Tenant Sync is not used because the partner users should not appear as guests in the directory (audit concerns). The resource tenant uses Conditional Access to require device compliance from the partner tenant, which is possible if trust for compliant device claims is enabled. The main challenge is that B2B Direct Connect does not support granular authorization based on group membership from the home tenant unless the resource application supports it. Therefore, SharePoint site permissions must be assigned manually to each user or to a security group in the resource tenant that contains the external users.