Cross Tenant Access does not work correctly

Question

Hello,

Cross Tenant Access has been set up as mentioned in this Microsoft blog, between organization A and organization B.

We tried testing where a user X from organization A tries to access SQL Server data of organization B, but that does not work, and a handshake error is received.

• An external user for user X was created in organization B
• The outbound and inbound settings have been configured for both organization A and organization B.
• organization A is from UK while organization B is from Netherlands.

Can someone help us with that?

Gr,
Manish Bundhun

Answer 1

Hi Manish Bundhun

Thanks for sharing the details, this is a good setup, and you’re quite close. The issue you’re running into is actually a common one in cross-tenant scenarios.

Even though Cross-Tenant Access and B2B collaboration are configured correctly, SQL Server access depends on how authentication is handled at the database level. The handshake error you’re seeing is usually related to authentication not being fully aligned rather than the tenant trust itself.

In this case, please make sure that the external user from tenant A is not just invited into tenant B, but also created inside the SQL database. Azure SQL doesn’t automatically grant access to B2B users, so you’ll need to create a contained database user mapped to that external identity. For example, you can connect as an admin in tenant B and run:

CREATE USER [******@tenantA.com] FROM EXTERNAL PROVIDER;

Another important point is the authentication method. Cross-tenant access will not work with SQL authentication, so the connection must use Azure AD authentication such as Active Directory Interactive or Password. It’s also worth checking that the client or tool you’re using is authenticating against the correct tenant (tenant B), as sometimes the login flow still points to the home tenant and results in a handshake failure.

Additionally, please confirm that an Azure AD admin is configured on the SQL Server in tenant B. Without this, Azure AD-based logins (including external users) won’t be authorized correctly.

If everything above looks good, I would also suggest reviewing Conditional Access policies to ensure that external users are not being blocked, and verifying that firewall or networking settings are not restricting access.

Overall, Cross-Tenant Access enables identity trust, but SQL still requires explicit user creation and proper Azure AD authentication configuration. The handshake error is typically a sign that one of these pieces is missing or mismatched.

If you’re able to share the exact error message, I’d be happy to help you narrow it down further.

Hope this helps!