Limit who can be invited by an organization

If you collaborate with another organization and want to limit who can be invited to that organization as a guest or a shared channel member in Teams, you can specify who can be invited in the cross-tenant access settings in Microsoft Entra ID.

Note

Changes to cross-tenant access settings may take six hours to take effect.

Create a security group

The easiest way to specify who can be invited to another organization is to use a security group. You can use a security group with a defined membership or a dynamic security group. You can use an existing security group or create a new one for this purpose.

To create a security group

1. Sign in to the Microsoft Entra admin center using a Global Administrator or Security Administrator account.
2. Expand Groups and then select All groups.
3. Select New group.
4. Choose Security for the Group type.
5. Type a Group name.
6. Optionally, add a description for the group.
7. For Microsoft Entra roles can be assigned to the group, choose No.
8. Select a pre-defined Membership type (required).
9. Add group owners and members or a dynamic query if you're using dynamic user membership.
10. Select Create. Your group is created and ready for you to add members.

Add an organization

To define collaboration rules with another organization, you have to add that organization to the Microsoft Entra cross-tenant access settings. If you haven't already added the organization, follow this procedure to add it.

To add an organization

1. In the Microsoft Entra admin center, expand External Identities, and then select Cross-tenant access settings.
2. Select Organizational settings.
3. Select Add organization.
4. On the Add organization pane, type the full domain name (or tenant ID) for the organization.
5. Select the organization in the search results, and then select Add.
6. The organization appears in the Organizational settings list. At this point, all access settings for this organization are inherited from your default settings.

Choose who can be invited by an organization

There are two options for limiting who can be invited to an organization:

• Limit who can be invited as a guest. This prevents users from being added to the other organization's Microsoft Entra ID as a guest. It prevents sharing of files, folders, sites, teams, and Microsoft 365 groups with people who aren't in the security group.
• Limit who can be added to an external shared channel. This prevents people who aren't in the security group from being added to shared channels in the other organization.

In the Microsoft Entra admin center, under External Identities, select Cross-tenant access settings.

To limit who can be invited as a guest

1. Select the outbound access link for the organization that you want to modify.
2. On the B2B collaboration tab, choose Customize settings.
3. Under Access status, choose Allow access.
4. Under Applies to, choose Select users and groups.
5. Select the link to add users and groups.
6. Search for and select the security group that you want to use.
7. Choose Select.
8. Select Save and close the Outbound access settings blade.

To limit who can be invited as a shared channel participant

1. Select the outbound access link for the organization that you want to modify.
2. On the B2B direct connect tab, choose Customize settings.
3. Under Access status, choose Allow access.
4. Under Applies to, choose Select users and groups.
5. Select the link to add users and groups.
6. Search for and select the security group that you want to use.
7. Choose Select.
8. Select Save and close the Outbound access settings blade.

Related topics

B2B direct connect overview

Configure cross-tenant access settings for B2B direct connect

Limit organizations where users can have guest accounts

Onboard trusted vendors to collaborate in Microsoft 365