Block cross-tenant B2B access by default and allow named partners

Description

The Default settings of cross-tenant access block B2B collaboration and B2B direct connect, inbound and outbound, for all users and applications. Each partner organization of {{ partner_tenants }} has an Organizational settings entry that allows only the B2B collaboration or direct connect it needs, for specific users, groups and applications where possible.

Trust settings (MFA, compliant device, hybrid joined device) are trusted only for partners whose policies have been assessed, never in the default settings.

The default B2B direct connect settings already block everything; this control keeps them that way.

Rationale

By default Microsoft Entra allows B2B collaboration with every tenant in both directions. Any user can be invited into, and share with, any organization, including throwaway tenants used for phishing and exfiltration. Blocking by default and listing partners turns external collaboration into an explicit, reviewed decision.

Impact

Collaboration with a new Microsoft Entra organization fails until it is added as a partner. Inbound guests from non-listed tenants can no longer redeem invitations or sign in. Users without an Entra tenant (consumer accounts, email one-time passcode) are not affected by these settings but by the domain allow list (CB-M365-TENANT-012). Teams external chat uses Teams external access settings, not these settings.

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader (Security Reader also works).
2. Browse to Entra ID > External Identities > Cross-tenant access settings > Default settings.
3. Inbound access settings and Outbound access settings: B2B collaboration and B2B direct connect show All blocked for users and applications. Trust settings are not checked.
4. Organizational settings: each entry belongs to {{ partner_tenants }}.
5. Read-only PowerShell alternative (Microsoft Graph, scope Policy.Read.All):

   $d = Get-MgPolicyCrossTenantAccessPolicyDefault
   $d.B2bCollaborationInbound.UsersAndGroups.AccessType, $d.B2bCollaborationOutbound.UsersAndGroups.AccessType
   Get-MgPolicyCrossTenantAccessPolicyPartner | Select-Object TenantId
   

6. Fail if a default direction allows access, if default trust settings are enabled, or if a partner entry is not in the parameter.

Remediation

1. Before changing defaults, add each partner of {{ partner_tenants }} in Organizational settings > Add organization, and allow the inbound and outbound access they need.
2. Review the cross-tenant sign-in activity (Monitoring & health > Workbooks > Cross-tenant access activity) to find missing partners.
3. With a Security Administrator, browse to Entra ID > External Identities > Cross-tenant access settings > Default settings.
4. Edit inbound defaults and Edit outbound defaults: on B2B collaboration and B2B direct connect, set Access status to Block access for users and applications; on Trust settings, uncheck all options. Save.
5. Equivalent with Microsoft Graph: PATCH /policies/crossTenantAccessPolicy/default with accessType: blocked on b2bCollaborationInbound, b2bCollaborationOutbound, b2bDirectConnectInbound and b2bDirectConnectOutbound.

Rollback

Select Reset to default in the default settings, or set the access status back to Allow access.

References

• Cross-tenant access overview Microsoft, vendor-doc, accessed 2026-10-24
• Configure cross-tenant access settings for B2B collaboration Microsoft, vendor-doc, accessed 2026-10-24
• ASD's Blueprint for Secure Cloud, cross-tenant access settings Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-TENANT-012 Allow guest invitations only to approved domains
• related CB-M365-COLLAB-018 Limit Teams external access to approved domains
• related CB-M365-POWER-006 Limit Power Platform tenant isolation exceptions to approved tenants
• related CB-M365-POWER-005 Enable Power Platform tenant isolation

People and lifecycle