Allow guest invitations only to approved domains

Description

Collaboration restrictions is set to Allow invitations only to the specified domains (most restrictive), and the list contains exactly the domains of {{ allowed_guest_domains }}. Invitations to any other domain, including consumer email providers, are refused.

Cross-tenant access settings (CB-M365-TENANT-014) can also allow or block B2B collaboration per Microsoft Entra tenant; the domain list here also covers external users without an Entra tenant.

Rationale

An allow list limits guest accounts, and therefore sharing through Entra B2B, to organizations with a business relationship. It blocks invitations to personal mailboxes used to exfiltrate data, and to lookalike domains set up by attackers.

Impact

Every new partner domain must be added before its users can be invited, which needs a request process. The list applies to new invitations; existing guests from other domains stay until they are reviewed (CB-M365-TENANT-013). Partners with several domains need each one listed.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > External Identities > External collaboration settings, section Collaboration restrictions.
3. Check that Allow invitations only to the specified domains (most restrictive) is selected and that the domain list matches {{ allowed_guest_domains }}.
4. Read-only alternative with Microsoft Graph (beta, scope Policy.Read.All): GET https://graph.microsoft.com/beta/policies/b2bManagementPolicies and read InvitationsAllowedAndBlockedDomainsPolicy.
5. Fail if invitations are allowed to any domain, if a deny list is used instead, or if the list contains domains outside the parameter.

Remediation

1. Collect the partner domains and set the parameter.
2. With an External Identity Provider Administrator or Global Administrator, browse to Entra ID > External Identities > External collaboration settings.
3. Under Collaboration restrictions, select Allow invitations only to the specified domains (most restrictive), enter one domain per line and Save.

Rollback

Select Allow invitations to be sent to any domain (most inclusive).

References

• Allow or block invitations to B2B users from specific organizations Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-TENANT-011 Restrict guest invitations to administrators and Guest Inviters
• related CB-M365-TENANT-014 Block cross-tenant B2B access by default and allow named partners
• related CB-M365-COLLAB-002 Enable SharePoint and OneDrive integration with Microsoft Entra B2B
• related CB-M365-COLLAB-005 Limit SharePoint and OneDrive external sharing to approved domains

People and lifecycle