{
  "id": "CB-M365-TENANT-014",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-014",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-014.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-014.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-014",
    "title": "Block cross-tenant B2B access by default and allow named partners",
    "finding": {
      "title": "Cross-tenant access defaults allow every Microsoft Entra tenant",
      "description": "Users can collaborate with, and be invited from or into, any Microsoft Entra organization, including tenants created by attackers."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "cross-tenant-access",
      "b2b",
      "external-identities",
      "allow-list"
    ],
    "parameters": [
      {
        "name": "partner_tenants",
        "type": "list",
        "description": "Tenant IDs or primary domains of partner organizations with their own cross-tenant access settings.",
        "default": []
      }
    ],
    "description": "The **Default settings** of cross-tenant access block B2B collaboration and B2B direct connect,\ninbound and outbound, for all users and applications. Each partner organization of\n`{{ partner_tenants }}` has an **Organizational settings** entry that allows only the B2B\ncollaboration or direct connect it needs, for specific users, groups and applications where\npossible.\n\n**Trust settings** (MFA, compliant device, hybrid joined device) are trusted only for partners\nwhose policies have been assessed, never in the default settings.\n",
    "rationale": "By default Microsoft Entra allows B2B collaboration with every tenant in both directions. Any\nuser can be invited into, and share with, any organization, including throwaway tenants used for\nphishing and exfiltration. Blocking by default and listing partners turns external collaboration\ninto an explicit, reviewed decision.\n",
    "impact": "Collaboration with a new Microsoft Entra organization fails until it is added as a partner.\nInbound guests from non-listed tenants can no longer redeem invitations or sign in. Users without\nan Entra tenant (consumer accounts, email one-time passcode) are not affected by these settings\nbut by the domain allow list (CB-M365-TENANT-012). Teams external chat uses Teams external access\nsettings, not these settings.\n",
    "notes": "The default B2B direct connect settings already block everything; this control keeps them that\nway.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader (Security Reader also works).\n2. Browse to **Entra ID** > **External Identities** > **Cross-tenant access settings** >\n   **Default settings**.\n3. **Inbound access settings** and **Outbound access settings**: B2B collaboration and B2B\n   direct connect show **All blocked** for users and applications. **Trust settings** are not\n   checked.\n4. **Organizational settings**: each entry belongs to `{{ partner_tenants }}`.\n5. Read-only PowerShell alternative (Microsoft Graph, scope `Policy.Read.All`):\n   ```\n   $d = Get-MgPolicyCrossTenantAccessPolicyDefault\n   $d.B2bCollaborationInbound.UsersAndGroups.AccessType, $d.B2bCollaborationOutbound.UsersAndGroups.AccessType\n   Get-MgPolicyCrossTenantAccessPolicyPartner | Select-Object TenantId\n   ```\n6. Fail if a default direction allows access, if default trust settings are enabled, or if a\n   partner entry is not in the parameter.\n"
    },
    "remediation": {
      "manual": "1. Before changing defaults, add each partner of `{{ partner_tenants }}` in **Organizational\n   settings** > **Add organization**, and allow the inbound and outbound access they need.\n2. Review the cross-tenant sign-in activity (**Monitoring & health** > **Workbooks** >\n   **Cross-tenant access activity**) to find missing partners.\n3. With a Security Administrator, browse to **Entra ID** > **External Identities** >\n   **Cross-tenant access settings** > **Default settings**.\n4. **Edit inbound defaults** and **Edit outbound defaults**: on **B2B collaboration** and\n   **B2B direct connect**, set **Access status** to **Block access** for users and\n   applications; on **Trust settings**, uncheck all options. **Save**.\n5. Equivalent with Microsoft Graph: `PATCH /policies/crossTenantAccessPolicy/default` with\n   `accessType: blocked` on `b2bCollaborationInbound`, `b2bCollaborationOutbound`,\n   `b2bDirectConnectInbound` and `b2bDirectConnectOutbound`.\n",
      "rollback": "Select **Reset to default** in the default settings, or set the access status back to\n**Allow access**.\n"
    },
    "references": [
      {
        "title": "Cross-tenant access overview",
        "url": "https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Configure cross-tenant access settings for B2B collaboration",
        "url": "https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD's Blueprint for Secure Cloud, cross-tenant access settings",
        "url": "https://blueprint.asd.gov.au/configuration/entra-id/external-identities/cross-tenant-access-settings/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-TENANT-012",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-018",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-006",
        "type": "related"
      },
      {
        "id": "CB-M365-POWER-005",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}