External Identities: Guest Access & B2B

What are external identities?

External collaboration settings

External collaboration settings are the master controls for guest access. Find them at: Entra admin center → External Identities → External collaboration settings.

Setting	What It Controls	Recommendation
Guest user access	What guests can see in your directory (all properties, limited, or most restrictive)	Limited properties for most orgs
Guest invite settings	Who can invite guests — everyone, members+admins, admins only, or nobody	Members + specific admins
Collaboration restrictions	Allow/deny invitations to specific domains	Deny known-bad domains; allow specific partners
Enable guest self-service sign-up	Guests can request access via user flows	Use for customer-facing apps

ℹ️ Scenario: Priya locks down guest access at Meridian Health

Healthcare data requires strict controls. Priya configures:

• Guest user access: Most restrictive — guests can’t enumerate directory users or groups
• Guest invite settings: Only admins and the Guest Inviter role can invite
• Collaboration restrictions: Allow list with only approved partner domains (medical suppliers, consulting firms)

This prevents random employees from inviting personal contacts as guests, which could expose patient-adjacent systems.

Inviting external users

Individual invitations

1. Entra admin center → Users → Invite external user
2. Enter their email address and a personal message
3. The guest receives an email with a redemption link
4. They click the link, authenticate with their home identity, and gain access

Bulk invitations

For inviting many guests at once:

• Entra admin center → Users → Bulk invite → download CSV template → upload
• PowerShell → New-MgInvitation in a loop

$guests = Import-Csv -Path "Partners.csv"
foreach ($guest in $guests) {
    New-MgInvitation -InvitedUserEmailAddress $guest.Email `
                     -InviteRedirectUrl "https://myapps.microsoft.com" `
                     -SendInvitationMessage $true
}

Redemption — how guests sign in

When a guest redeems their invitation, they authenticate using (in priority order):

1. Their own Entra ID tenant (if they have one)
2. A configured external identity provider (Google, Facebook, SAML/WS-Fed)
3. Microsoft account (personal Outlook/Hotmail)
4. Email one-time passcode (OTP) — a 6-digit code sent to their email

💡 Exam tip: redemption order matters

The exam tests that you understand the identity provider priority. If a guest’s organisation has an Entra tenant, they’ll use that — even if you’ve also configured Google federation. The order is: Entra ID tenant → configured external IdP → Microsoft account → email OTP.

Email OTP is the fallback when nothing else matches. It’s enabled by default and works for any email address.

Managing guest accounts

Guest users appear in your directory with a UserType of “Guest” (vs “Member” for internal users).

Key management tasks:

Task	How
Convert guest to member	Change UserType in user properties
Block guest sign-in	Set accountEnabled to false
Set expiration	Access reviews or entitlement management (covered in Domain 4)
Remove guest	Delete the guest user object
Restrict guest permissions	Use external collaboration settings or CA policies

ℹ️ Scenario: Jake manages freelancer guest access

Coastline Creative works with 15 freelance designers. Jake invites them as guests and:

• Assigns them to a “Freelancers” security group
• Grants group access to the shared design SharePoint site
• Creates a Conditional Access policy: guests must use MFA
• Sets a quarterly access review to clean up stale accounts

When a freelancer’s project ends, the access review catches their inactive account and triggers removal. No orphaned guest accounts cluttering the directory.

External identity providers

By default, guests use their own Entra tenant or email OTP. You can add external identity providers for a smoother sign-in experience:

Provider	Protocol	Use Case
Google	OAuth 2.0 / OpenID Connect	Partners with Google Workspace
Facebook	OAuth 2.0	Customer-facing B2C apps
SAML/WS-Fed identity provider	SAML 2.0 or WS-Federation	Enterprise partners with non-Microsoft IdPs (Okta, Ping, etc.)

SAML/WS-Fed federation

For enterprise partners using non-Microsoft identity providers (Okta, Ping Identity, ADFS):

1. Configure the partner’s IdP as a SAML or WS-Fed identity provider in your tenant
2. Map the partner’s domain to the federation
3. When guests from that domain are invited, they authenticate via their own IdP

💡 Exam tip: SAML vs WS-Fed

Both SAML 2.0 and WS-Federation achieve the same goal — federated authentication with external IdPs. The exam may ask which to choose:

• SAML 2.0 — industry standard, works with almost any IdP (Okta, Ping, OneLogin)
• WS-Federation — older Microsoft protocol, primarily for ADFS and legacy Microsoft environments

Default guidance: Use SAML 2.0 unless the partner specifically requires WS-Fed.

🎬 Video walkthrough

🎬 Video coming soon

External Identities — SC-300 Module 5

External Identities — SC-300 Module 5

~11 min

Flashcards

Question

What is the redemption priority order for guest users in Entra External ID?

Click or press Enter to reveal answer

Answer

1) Their own Entra ID tenant, 2) Configured external identity provider (Google, SAML/WS-Fed), 3) Microsoft account, 4) Email one-time passcode (OTP). The first matching option is used.

Click to flip back

Question

What are the guest invite settings options in External collaboration settings?

Click or press Enter to reveal answer

Answer

Who can invite guests: 1) Anyone in the org (including guests), 2) Members and specific admin roles, 3) Only admin roles, 4) No one. Controls who can send B2B invitations to external users.

Click to flip back

Question

How do you configure federation with a partner using Okta as their identity provider?

Click or press Enter to reveal answer

Answer

Add a SAML 2.0 identity provider in Entra → External Identities → All identity providers. Map the partner's domain to the SAML federation. When guests from that domain are invited, they authenticate via Okta.

Click to flip back

Knowledge Check

Knowledge Check

Anika's client needs to invite 200 consultants from a partner firm that uses Okta as their identity provider. The client wants consultants to sign in with their existing Okta credentials. What should Anika configure?

ACreate 200 new user accounts in the client's tenant with Okta passwordsBAsk the partner to migrate all consultants to Microsoft accounts firstCConfigure a SAML 2.0 federation with the partner's domain and then bulk-invite the consultantsDSet up a VPN tunnel between the two organisations

Check Answer

Knowledge Check

A guest user from a partner company reports they can't sign in. The partner doesn't have an Entra tenant or Microsoft accounts. What authentication method will Entra use as a fallback?

AThe guest cannot sign in — they must create a Microsoft account firstBEntra will redirect them to create an Entra ID accountCWindows Hello for Business will be used automaticallyDEntra will send a one-time passcode (OTP) to their email address

Check Answer

---

Next up: Cross-Tenant Access & Synchronisation — control how your tenant trusts and shares with other Entra ID tenants using cross-tenant access settings and sync.