This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 59%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESA%3C/text%3E%3C/svg%3E)
Users are MFA Enabled in Home Tenant where they would be invited to collaborate to work in Guest Tenant and the Guest Tenant doesn't configure any MFA policies for this users.
When such users login to Azure Portal would they be prompted for MFA of Home Tenant to access the Guest Tenant or is there any chance that they can directly access Guest Tenant without any MFA prompt from Home Tenant?
If yes please let me know how they would be able to Login so that I can work on enforcing MFA for those users in Guest Tenant.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Hi @Sravan Akkaram ,
Yes, the user will receive an MFA prompt from the home tenant. If MFA is then enforced on the guest tenant, they'll have two separate MFA prompts - one from the home tenant and one from the guest tenant. They are two separate MFA registrations.
The inviting organization is always ultimately responsible for multi-factor authentication, and there isn't a way right now to "trust" the multifactor authentication from the other tenant. This is documented in the FAQ and there are detailed discussions around this topic in the partner forum and on Github.
The ability to trust MFA from the home tenant has been requested for a while, and if you would like to bubble this up with the product team you can make a request in the newly revised Ideas forum. I will also surface this back to their attention.
Let me know if this helps at all.
Thanks @Marilee Turscak-MSFT for the confirmation.
It would be great if you can also clarify me the below points based on your answers.
Earlier the ability to trust MFA from Home Tenant has been confirmed by Microsoft but later now recommending to enforce MFA by the inviting Tenant as we can't trust MFA of Home Tenant so does this mean the Home Tenant MFA can be bypassed for the users who access the Guest Tenant or its just that to further enhance the security posture of the users?
Need to understand this as most of our clients still trust that Home Tenant MFA would be prompted for the invited users because users would always login to Azure portal and satisfy the MFA of Home Tenant then switch to Guest tenant directory. Is there any way that they can directly login to guest tenant directory so that MFA of Home Tenant would be bypassed? If it's so then I hope it should be considered a security issue?
@Marilee Turscak-MSFT Awaiting for your response on understanding this?
The MFA won't be bypassed. The user will just receive two separate MFA prompts (one for the home tenant and one for the guest tenant).
Thanks @Marilee Turscak-MSFT for the answers. It would be great if you also help me with one last question on this as I didn't get that answer earlier.
Is there any way or any process that we can directly access Guest Tenant directory without logging in to Home Tenant directory? Let's say a URL which helps in directly accessing it?
Appreciate your support on this. Thanks
@Marilee Turscak-MSFT Could you please help me in understanding the above if there is any process or a way to login to Guest Tenant using a specific URL without logging in to Home Tenant? Or is it mandatory or only way that initially we should login to home Tenant and then switch to the guest tenant?
Appreciate your support.Thanks
@Marilee Turscak-MSFT Awaiting for your response, can you please answer to the above queries?
Sorry for the delay! They can use the direct URL: https://portal.azure.com/tenantnamehere.onmicrosoft.com
Update:
I wanted to follow up on this thread and mention that Microsoft just rolled out "Cross Tenant Access Settings" for M365/AzureB2B. This means:
1) External guest users will no longer be double-prompted for Multi-factor Authentication for their home tenant and the destination tenant.
2) You can restrict which organizations your employees can authenticate against (previously this required a network proxy solution)
Collaborate More Securely With New Cross-Tenant Access Settings