Entra ID B2B guest access

Entra ID B2B is the mechanism by which external users — partners, customers, contractors — sign into your tenant using their own identity, rather than getting a new account from you. They appear in your directory as guests, and you grant them access to apps, files, and Teams as if they were internal users (with appropriate controls).

When you invite an external user (an email address from another organisation, a personal Microsoft account, or a Google or Facebook account):

Entra ID creates a guest user object in your directory.
The user signs in using their home identity provider — most commonly another Entra ID tenant.
Authentication happens at the home tenant; your tenant trusts the result.
Your tenant applies its own Conditional Access, app role assignments, and access controls on top.

The user doesn't get a new password. Your tenant doesn't store their credentials. If they leave their home company, their account there is disabled and access to your tenant breaks naturally.

Cross-Tenant Access Settings

For B2B with other Microsoft 365 tenants, Cross-Tenant Access Settings (CTAS) give you fine-grained control over both inbound and outbound trust:

Which other tenants are allowed.
Which users/groups from them can be invited.
Which apps they can access.
Whether the trust covers MFA and device compliance (so the home tenant's MFA satisfies yours).
Whether shared channels in Teams are enabled with that partner.

CTAS is the modern surface for designing partnership trust — it replaces older per-app or per-user configurations.

Inviting guests

Methods:

A user clicks Share on a SharePoint file or Teams channel and types an external email.
An admin invites from the Entra admin center.
An app provisions guests via the Microsoft Graph.
An entitlement management access package automates invitations and approvals.

Lifecycle

Guests can drift. Practical hygiene:

Access reviews for guests, periodically — ask owners to confirm continued need.
Guest inactivity policies — auto-disable or auto-delete guests not active for N days.
Sponsorship — make sure every guest has an internal sponsor who's accountable.
Default user permissions — restrict what guests can see (default is "limited access").

Differences from federation

In B2B, the guest is in your directory as a separate object. In federation (Entra ID's older same-trust model), users live entirely in another directory. B2B is more granular, easier to operate, and the modern default.

For ongoing collaboration, B2B is the right answer for most external relationships. Reserve full account creation for actual employees and long-term contractors.

Frequently asked questions

What is a B2B guest in Entra ID?

An external person represented in your tenant as a guest user object, who authenticates with their own identity (their Entra tenant, a Microsoft account, Google, or a one-time email code) and can be granted access to your apps, groups, Teams, and SharePoint sites.

Do guests need a licence?

Guests are covered by the licences of your own users at a ratio of 1:5 for most features under the monthly-active-user model, where the first 50,000 monthly active external users are free. Practically, most tenants never pay for guests.

How do I remove guests who no longer need access?

Combine guest expiration in SharePoint, access reviews of guests in Entra (P2), and a periodic report of guests with no sign-in in 90 days. Removing the guest user object removes all their access at once.