B2B user accessing exchange mailbox via resource tenant

Question

Hello,

My tenant is contoso.com and I have one guest user in it with ******@fabrikam.com

when John hits "OWA- outlook web access" and if the authentication request is directed to my contoso.com tenant , contoso will prepare the token and john will see his mailbox.

Would above be possible and if answer is yes then
how would it be different if the authentication request was directed to John's home tenant i.e., fabrikam.com and fabrikam would have prepared the token to put John on his mailbox.

Thanks.

Answer 1

Not sure I understand the question here, are you asking whether Guest users can have a mailbox in the resource tenant? If so, the answer is yes, however this is not a supported scenario. It requires you to "convert" the userType to Member first, then you can assign a license: https://www.michev.info/Blog/Post/2256/some-new-interesting-experiences-with-guest-users-in-office-365
Again, this is not really supported, as Exchange Online has no support for B2B. So while you can technically provision the mailbox, the user will not be able to access it. Well he can, if you reset his password in the resource tenant and login directly (another unsupported scenario). But you can still grant permissions on the mailbox and have someone else access it.

And yes, it matters where you authenticate from. The supported scenario for a B2B user, even one with userType set to member, is to authenticate against their own AAD (you will notice that the user still has "ExternalAzureAD" value under Identities in the Azure portal). While you can technically override this by creating/resetting a password in the resource tenant, this is not supported.
This article goes over the various types of B2B users and their properties: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/user-properties

Answer 2

Can you help me please.
I am trying to create following simple "claim-mapping-policy" and attaching it on the service-principal of client-app.

{
"definition": [
"{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\",\"ClaimsSchema\": [{\"Source\":\"user\",\"ID\":\"proxyaddresses\",\"JwtClaimType\":\"proxyaddresses\"}]}}"
],
"displayName": "Test1234"
}

However, I still DO NOT FIND proxyaddresses coming in the id-token