Cross-Tenant SharePoint Access + Graph API Access Without App Registration in Resource Tenant

Question

Cross-Tenant SharePoint Access + Graph API Access Without App Registration in Resource Tenant

Manasa Chandu 20

Hi Team,

I need guidance on a cross-tenant SharePoint access scenario involving both user access and API access.

Title: Cross-Tenant SharePoint Access + Graph API Access Without App Registration in Resource Tenant

Body: Hi Team,

I need guidance on a cross-tenant SharePoint access scenario involving both user access and API access.

Architecture (as per diagram):

Tenant A Contains Microsoft SharePoint resources (Site Pages, content)
```
Has its own Microsoft Entra ID
```

Tenant B Contains users and its own Entra ID

Users authenticate here

Current situation:

   Users in Tenant B **cannot access SharePoint in Tenant A**

      There is **no cross-tenant trust configured yet**

         Diagram shows attempted interaction between ADs and SharePoint across tenants (currently blocked)

Requirement:

Enable users from Tenant B to access SharePoint (Tenant A)

Prefer seamless experience (SSO-like, minimal tenant switching)

Also explore programmatic access using Graph API

What We’re Exploring:

B2B Guest Access

Cross-Tenant Access Settings

B2B Direct Connect

Key Questions (User Access):

What is the recommended approach for SharePoint Online cross-tenant access?

Is Cross-Tenant Access configuration alone sufficient, or are Guest Users still mandatory?

Can we achieve seamless access without explicit guest invitations?

Key Questions (Graph API / Backend Access):

Can users from Tenant B access SharePoint Site Pages in Tenant A using Microsoft Graph without app registration in Tenant A?

If a user signs in from Tenant B, can their token be used directly to call Graph APIs for Tenant A resources?

Is multi-tenant app registration in Tenant B sufficient, or is app registration in Tenant A always required for SharePoint data access?

Are there supported patterns for accessing:

SharePoint Site Pages

  SharePoint **content/lists** across tenants via Graph?

Assumptions / Constraints:

Tenants are under different administrative control

We can coordinate admin-level changes if required

Security and governance are important

Looking to avoid unnecessary duplication (like creating users manually if possible)

Goal:

To design a solution where:

Identity stays in Tenant B

Resources remain in Tenant A

Access (UI + API) works securely and seamlessly

Any best practices, architecture guidance, or official recommendations would be very helpful.

Thanks!

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

For SharePoint Online across tenants, the foundation is Microsoft Entra External ID with cross-tenant access settings; B2B collaboration identities are still the supported way to represent users from another tenant.

Recommended approach for SharePoint cross-tenant user access

Use B2B collaboration + cross-tenant access settings
- Cross-tenant access settings define how users from Tenant B can access resources in Tenant A and vice versa. These are configured per partner tenant and separately for inbound and outbound directions.
- B2B collaboration users (guest or B2B member) are the supported identity model for users from another tenant to access Microsoft 365 resources such as SharePoint.
Automatic redemption to reduce friction
- The automatic redemption setting in cross-tenant access can suppress consent prompts and invitation emails when both the home/source tenant (Tenant B outbound) and resource/target tenant (Tenant A inbound) enable it.
- When both sides have the automatic redemption setting checked, the consent prompt is suppressed for source-tenant users accessing the resource tenant.
Seamless experience (SSO-like)
- With cross-tenant access configured and B2B collaboration in place, users authenticate in their home tenant (Tenant B) and get SSO to resources in Tenant A using their home credentials.
- For multitenant organizations under common control, cross-tenant synchronization and multitenant organization capabilities can further streamline the experience (for example, synchronized B2B member users appearing as regular collaborators in Microsoft 365 apps).
Are guest users mandatory?
- Cross-tenant access settings alone do not replace the need for a representation of the external user in the resource tenant. B2B collaboration users (guest or B2B member) remain the supported pattern for SharePoint and Microsoft 365 access.
- Cross-tenant synchronization can automate creation and lifecycle of these B2B users across tenants, avoiding manual user creation while keeping identity anchored in Tenant B.
B2B Direct Connect
- B2B direct connect is currently scoped to Teams Connect shared channels only. It is not a general replacement for B2B collaboration for SharePoint access.

Graph API / backend access across tenants

Identity and token model
- Access to SharePoint content via Microsoft Graph in Tenant A requires:
  - A user or app identity that Tenant A trusts (typically a B2B collaboration user from Tenant B or an app consented in Tenant A), and
  - Appropriate authorization (SharePoint/Graph permissions) granted in Tenant A.
App registration location
- Cross-tenant access settings and B2B collaboration focus on user identities and access control, not on eliminating the need for app consent in the resource tenant.
- For an application to call Microsoft Graph against Tenant A’s resources, Tenant A must consent to that application’s permissions. This is true whether the app is:
  - Single-tenant in Tenant A, or
  - Multi-tenant, originally registered in Tenant B but consented by an admin in Tenant A.
Can this work without any app registration in Tenant A?
- A multi-tenant app registered in Tenant B can be used to access Tenant A’s SharePoint data if Tenant A’s admin consents to that app and grants the required Graph permissions for Tenant A.
- That consent process effectively onboards the app into Tenant A’s directory as a service principal. This is still an app object in Tenant A’s directory, even though the registration lives in Tenant B.
- Therefore, while a separate app registration in Tenant A is not strictly required, Tenant A must still explicitly trust and authorize the app via consent.
Using Tenant B user tokens for Tenant A resources
- When a Tenant B user is a B2B collaboration user in Tenant A and signs in to a multi-tenant app, the app can request tokens for Microsoft Graph scoped to Tenant A, provided:
  - Cross-tenant access and B2B collaboration are configured to allow that access, and
  - The app has the necessary Graph permissions consented in Tenant A.
- The token will be issued for Tenant A as the resource tenant, but the identity is the B2B user whose home account is in Tenant B.
Supported patterns for SharePoint Site Pages and lists across tenants
- Use B2B collaboration users (possibly synchronized via cross-tenant synchronization) to represent Tenant B identities in Tenant A.
- Configure cross-tenant access settings between Tenant A and Tenant B to allow B2B collaboration and to optimize consent/invitation behavior (for example, automatic redemption).
- Use a multi-tenant app (registered in one tenant) and have Tenant A’s admin consent to the required Microsoft Graph permissions for SharePoint content (sites, lists, pages) in Tenant A.
- The app then calls Microsoft Graph against Tenant A’s endpoints using tokens issued for Tenant A, acting on behalf of B2B users from Tenant B or as an application, depending on the chosen permission model.

Putting it together for the stated goal

To keep identity in Tenant B, resources in Tenant A, and provide seamless UI + API access:

Configure cross-tenant access settings between Tenant A and Tenant B for B2B collaboration, including automatic redemption where appropriate.
Use B2B collaboration (optionally with cross-tenant synchronization) so Tenant B users are represented in Tenant A without manual user creation.
For UI access, grant these B2B users appropriate SharePoint permissions in Tenant A.
For API access, use a multi-tenant app (registered in one tenant) and have Tenant A’s admin consent to the app’s Graph permissions for Tenant A. The app can then call Microsoft Graph for SharePoint sites, pages, and lists in Tenant A on behalf of B2B users or as an app.

References: