Share via

Microsoft Admin Portals app cannot be add in Cross-Tenant Access Policies (inbound and outbound)

Guillaume Bossiroy 25 Reputation points
2023-12-22T07:22:32.25+00:00

Hi,

I have noticed that the Microsoft Admin portals application cannot be added in the inbound access trust settings for an organization in Microsoft Entra ID. While adding other applications, like the Windows Azure Service Management API, works perfectly, adding the Microsoft Admin portals apps return the following error when trying to save the B2B collaboration inbound access policy: "Cross-tenant access settings, Found invalid target for Applications"

image

The Audit Log returns the following:

image

Is this the expected behavior? Why is it failing for that application in particular? This app suits perfectly our use case and would therefore like to have this working. I didn't see any limitations or remarks about this app in particular in the documentation.

Step to reproduce

  1. In Entra ID > External Identities > Cross-tenant access settings
  2. Add an organization and modify its inbound access settings or adapt the inbound access setting of an existing organization
  3. Under B2B collaboration, select Customize settings:
  • Under external users and groups, select Allow access and All Organization users and groups
  • Under Applications, select Allow access and select Select applications. Then, click on Add Microsoft applications, search for Microsoft Admin Portals, select it and add it.
  1. Click on Save
  2. The error as show above is returned

Thank you in advance,

Guillaume

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
Microsoft Security | Microsoft Entra | Microsoft Entra ID

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator
    2024-01-10T08:01:02.57+00:00

    @Guillaume Bossiroy Thank you for reaching out to us, apologies for the delayed response on this, the only valid app for selecting via GUI today  is "Office 365" however if you want to add another app, you can leverage Graph API and add via AppId.

    Follow the below steps to achieve your ask.

    1. Open Graph Explorer https://aka.ms/ge and sign in with tenant Global Administrator and also make sure necessary permissions are provided while making the below changes - https://learn.microsoft.com/en-us/graph/api/crosstenantaccesspolicy-update?view=graph-rest-1.0&tabs=http
    2. Run a request to GET https://graph.microsoft.com/beta/policies/crossTenantAccessPolicy/partners/abc12345-5XXX-XXXX-XXXX-04XXX03XXX7f0?$select=b2bCollaborationInbound , replacing partner tenant ID with the partner you wish to modify inbound XTAP policy for.
    3. Review the response section to verify the current b2bCollaborationInbound policy is returned.
    4. Copy the entire response section result, and paste it in the top half of Graph Explorer labelled the Request Body
    5. In the Request Body section you have populated, locate the applications section, and the list of target apps.
    6. Add a new target app to the list by adding a comma after the existing target app and adding a new app to the list. for reference below screenshot

    User's image

    1. change the Graph Explorer request type from GET to PATCH as we will be saving our updates to the policy. And then click Run query to update the policy.

    8.If all is successful, the Graph Explorer response should show a 204-response code

    1. Browsing back to the Azure Portal's XTAP inbound policy applications list, should have the desired application which we added.

    Let me know if you have any further questions, feel free to post back.

    Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.