Most engineers think…
Most people treat 'B2B' and 'External Identities' as the same thing. That mental model breaks in interviews and in production.
Microsoft Entra External ID is a platform with four distinct scenarios, not one feature. B2B collaboration creates a lightweight guest object and lets the partner authenticate with their own identity provider. B2B direct connect enables Teams shared channels with no guest object at all. Cross-tenant access settings give you fine-grained per-tenant control over both. And External ID for customers is the developer-facing CIAM replacement for Azure AD B2C. Knowing which scenario applies to a given problem is what separates a junior engineer from someone who can design an external-collaboration strategy.
① Microsoft Entra External ID — one platform, four scenarios
Microsoft Entra External ID sits under the External Identities section of the Entra admin centre and covers every situation where a user from outside your organisation needs access to something you control. The platform has four distinct scenarios you must be able to name:
- B2B collaboration — invite a partner user as a guest; they authenticate with their own IdP (Microsoft Entra, Google, email OTP, etc.) and get controlled access to your apps and resources.
- B2B direct connect — bidirectional trust for Teams shared channels; no guest object is created in your directory, but you still control access via cross-tenant access settings.
- Cross-tenant access settings — the control plane for both of the above: inbound (what external users can do in your tenant) and outbound (what your users can do in other tenants), scoped to specific orgs, users, groups, and apps.
- External ID for customers — a full CIAM capability for developer-built consumer apps, where users self-register via email, social providers, or custom IdPs, replacing Azure AD B2C for new projects.
The platform-level answer to 'What is Entra External ID?' is: one unified home for partner access (B2B), seamless channel collaboration (direct connect) and consumer-app identity (CIAM).
Which Entra External ID scenario creates no guest user object in the resource tenant?
② B2B collaboration — the guest user lifecycle end to end
B2B collaboration is the most common External ID scenario. An admin or permitted user sends an invitation email to an external address. The invitation contains a one-time redemption link. On first redemption the guest chooses (or is auto-matched to) an identity provider — their own Microsoft Entra organisation, a Google account, a federation, or email OTP. A lightweight guest user object (UserType = Guest) is created in your tenant; no credentials are stored there.
Lifecycle stages to know
After redemption the guest is assigned to apps, groups, SharePoint sites, or Teams via the normal Entra assignment flow. At any point an admin can review guest access using Access Reviews — automated periodic checks that can remove stale guests automatically. Removal is straightforward: delete the guest object, which revokes all access immediately. The interview trap: guests do not inherit your MFA policy unless your Conditional Access targets them explicitly, and they do not see each other's profiles by default.
External collaboration settings (under External Identities) control who can invite guests (all users, specific roles, or admins only), and the allowed identity providers for redemption. B2B collaboration works across any Microsoft Entra tenant without pre-configuring per-tenant trust — the default cross-tenant access settings allow it, but you can override per org.
Invite an external user as a guest. A lightweight guest object (UserType=Guest) is created in your tenant; the user authenticates with their own identity provider. No credentials stored in your directory.
Bidirectional trust for Teams shared channels. No guest object is created in your directory — the external user's home tenant identity is used. Both tenants must enable it in cross-tenant access settings.
The policy layer for all cross-tenant traffic. Configures inbound and outbound rules per partner tenant for B2B collaboration and B2B direct connect, including trust for MFA and device compliance claims.
CIAM for developer-built consumer apps. Lives in a separate external tenant. Supports self-service sign-up, social IdPs, branded user flows, and native auth APIs. Replaces Azure AD B2C for new projects.
By default, all users in your tenant can invite external guests — not just admins. If your organisation handles sensitive data, tighten this in External collaboration settings (External Identities ▸ External collaboration settings) to 'Only users assigned to specific admin roles can invite'. This is a common audit finding.
A partner user is invited via B2B collaboration. Where are their credentials stored after redemption?
③ Cross-tenant access settings & B2B direct connect
Cross-tenant access settings are the policy layer governing all cross-tenant traffic. They have two axes: inbound (external users coming into your tenant) and outbound (your users going to other tenants). For each direction you can allow or block B2B collaboration and B2B direct connect, scoped to specific users, groups, and applications. There is no limit to the number of partner tenants you can configure.
The key power feature: you can trust MFA and device-compliance claims from a partner tenant, so your Conditional Access policy does not force re-authentication for a partner user who already satisfied MFA in their home tenant. Similarly, you can trust Hybrid Azure AD Joined or Compliant device claims from a known partner org — essential for zero-trust scenarios.
B2B direct connect
B2B direct connect enables bidirectional collaboration for Teams shared channels. Unlike B2B collaboration, it creates no guest user object in the resource tenant — the external user's identity is their own home tenant object and they appear in the shared channel as a member. Both tenants must configure cross-tenant access settings to allow B2B direct connect inbound and outbound. The primary current use case is Teams Connect shared channels; the feature is not yet available for SharePoint-only access.
B2B collaboration and B2B direct connect are separately configured and solve different problems. Collaboration creates a guest object and suits SharePoint, apps, and most resource access. Direct connect creates no guest object and currently suits only Teams shared channels. Enabling one does not enable the other — both must be turned on explicitly in cross-tenant access settings if needed.
▶ Watch a B2B guest invitation travel end to end
Follow one partner user from invitation email to resource access. Press Play for the healthy path, then Break it to see the classic redemption failure.
You want partner users from Contoso (another Entra tenant) to satisfy your Conditional Access MFA requirement using the MFA they already completed in Contoso's tenant. What do you configure?
④ External ID for customers (CIAM) — and deployment gotchas
External ID for customers is the CIAM face of Entra External ID. Unlike B2B collaboration (designed for known partner users), CIAM is for consumer-facing apps where end users self-register. It lives in a separate external tenant (a dedicated Entra tenant in external configuration). Developers register apps in the external tenant, configure custom sign-up/sign-in user flows (email & password, Google, Facebook, Apple, custom OIDC/SAML IdPs), and brand the experience with company colours and logo.
Key differentiation: Azure AD B2C (the legacy CIAM product) is no longer available for new customers as of May 2025 — all new CIAM projects should use External ID for customers. Migration tooling and documentation is available for existing Azure AD B2C tenants. External ID for customers supports native authentication APIs, giving mobile apps full control over the sign-in UX without redirect flows.
Deployment gotchas you will be asked about
The most common interview questions: (1) Can guests from one B2B collaboration tenant also use B2B direct connect? Yes, but both settings must be independently enabled. (2) Does deleting a guest object in your tenant affect the user in their home tenant? No — only the guest object in your tenant is removed. (3) Who can invite guests by default? All users in the org — tighten to admin-only roles if you have a sensitive tenant.
Priya at a Pune-based SaaS company faces this
A vendor partner from a UK company is added as a B2B collaboration guest, but their Teams messages in a shared project workspace are failing and they cannot join any Teams meetings in your tenant.
The partner needs access to a Teams shared channel, but B2B direct connect is not configured — only B2B collaboration is enabled. Teams shared channels require B2B direct connect, not just guest objects.
Check External Identities in Entra admin centre. The partner is listed as a guest (UserType=Guest) but the cross-tenant access settings for the UK tenant do not have B2B direct connect enabled inbound or outbound.
Entra Admin Centre ▸ External Identities ▸ Cross-tenant access settings ▸ Organisational settingsAdd the UK partner tenant in cross-tenant access settings. Enable B2B direct connect inbound (allows their users into your tenant for shared channels) and ask the partner admin to enable it outbound from their side too. Both sides must opt in.
The partner user can now join the Teams shared channel under their home-tenant identity. No new guest object is required. Validate in Teams admin centre that the shared channel shows the partner as an external member.
Many access failures trace to the guest object's UserType or the redemption state. In Microsoft Graph or the Entra admin centre, verify that UserType is 'Guest', that invitationAccepted is true, and that the object is in the expected tenant. A guest whose invitation was never redeemed has very limited access and cannot be assigned to most resources.
A developer is building a consumer-facing mobile app in 2026 and needs self-service sign-up with Google and Apple social sign-in. Which solution is the correct starting point?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what is the key difference between B2B collaboration and B2B direct connect in terms of directory objects? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- B2B Collaboration
- Entra External ID scenario that invites external users as guests. A guest object (UserType=Guest) is created in the resource tenant; the user authenticates with their own identity provider.
- B2B Direct Connect
- Entra External ID scenario enabling Teams shared channels without creating a guest object. Both tenants must enable it in cross-tenant access settings.
- Cross-Tenant Access Settings
- Per-partner-tenant policies controlling inbound (external users into your tenant) and outbound (your users into other tenants) B2B collaboration and direct connect traffic, plus optional MFA and device-compliance trust.
- Guest User Object
- A lightweight Entra ID user record (UserType=Guest) created in the resource tenant when a B2B collaboration invitation is redeemed. No credentials are stored — the user authenticates at home.
- External ID for Customers
- Microsoft CIAM capability for consumer-facing apps in a dedicated external tenant. Supports self-service sign-up, social IdPs, branded user flows, and native auth APIs. Replaces Azure AD B2C for new projects.
- Access Review
- An Entra Identity Governance feature that periodically checks whether guest (or member) access is still appropriate. Can auto-remove guests not approved by a reviewer.
- Redemption
- The process by which an invited B2B guest clicks the invitation link, authenticates with their home identity provider, and completes creation of their guest object in the resource tenant.
- MFA Claim Trust
- A cross-tenant access setting that instructs your Conditional Access policy to accept an MFA claim satisfied in the guest's home tenant, avoiding a second MFA challenge in your tenant.
📚 Sources
- Microsoft Learn — What is Microsoft Entra External ID? learn.microsoft.com/en-us/entra/external-id/external-identities-overview
- Microsoft Learn — What is Microsoft Entra B2B collaboration? learn.microsoft.com/en-us/entra/external-id/what-is-b2b
- Microsoft Learn — Cross-tenant access overview — Microsoft Entra External ID learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview
- Microsoft Learn — B2B direct connect overview — Microsoft Entra External ID learn.microsoft.com/en-us/entra/external-id/b2b-direct-connect-overview
- Microsoft Learn — External Tenant Overview — External ID for customers (CIAM) learn.microsoft.com/en-us/entra/external-id/customers/overview-customers-ciam
- Microsoft Learn — B2B collaboration invitation redemption experience learn.microsoft.com/en-us/entra/external-id/redemption-experience
What's next?
Got External Identities covered? Next, go deep on Entra ID Conditional Access — how policy conditions (user, device, location, risk) combine with grant and session controls to enforce zero-trust access for both internal and external users.