External Identities: Guest Access & B2B
Invite contractors, partners, and vendors to collaborate securely with Microsoft Entra External ID — without creating internal accounts.
What are external identities?
External identities are like visitor passes for your office building.
You don’t give visitors a permanent employee badge. Instead, they sign in at reception (using their own ID), get a visitor pass, and can access only the meeting rooms you’ve booked for them. When the visit ends, the pass expires.
Microsoft Entra External ID works the same way. External users sign in with their own identity (their work account, Google account, or even just an email code) and get limited access to the resources you share with them.
External collaboration settings
External collaboration settings are the master controls for guest access. Find them at: Entra admin center → External Identities → External collaboration settings.
| Setting | What It Controls | Recommendation |
|---|---|---|
| Guest user access | What guests can see in your directory (all properties, limited, or most restrictive) | Limited properties for most orgs |
| Guest invite settings | Who can invite guests — everyone, members+admins, admins only, or nobody | Members + specific admins |
| Collaboration restrictions | Allow/deny invitations to specific domains | Deny known-bad domains; allow specific partners |
| Enable guest self-service sign-up | Guests can request access via user flows | Use for customer-facing apps |
Scenario: Priya locks down guest access at Meridian Health
Healthcare data requires strict controls. Priya configures:
- Guest user access: Most restrictive — guests can’t enumerate directory users or groups
- Guest invite settings: Only admins and the Guest Inviter role can invite
- Collaboration restrictions: Allow list with only approved partner domains (medical suppliers, consulting firms)
This prevents random employees from inviting personal contacts as guests, which could expose patient-adjacent systems.
Inviting external users
Individual invitations
- Entra admin center → Users → Invite external user
- Enter their email address and a personal message
- The guest receives an email with a redemption link
- They click the link, authenticate with their home identity, and gain access
Bulk invitations
For inviting many guests at once:
- Entra admin center → Users → Bulk invite → download CSV template → upload
- PowerShell →
New-MgInvitationin a loop
$guests = Import-Csv -Path "Partners.csv"
foreach ($guest in $guests) {
New-MgInvitation -InvitedUserEmailAddress $guest.Email `
-InviteRedirectUrl "https://myapps.microsoft.com" `
-SendInvitationMessage $true
}Redemption — how guests sign in
When a guest redeems their invitation, they authenticate using (in priority order):
- Their own Entra ID tenant (if they have one)
- A configured external identity provider (Google, Facebook, SAML/WS-Fed)
- Microsoft account (personal Outlook/Hotmail)
- Email one-time passcode (OTP) — a 6-digit code sent to their email
Exam tip: redemption order matters
The exam tests that you understand the identity provider priority. If a guest’s organisation has an Entra tenant, they’ll use that — even if you’ve also configured Google federation. The order is: Entra ID tenant → configured external IdP → Microsoft account → email OTP.
Email OTP is the fallback when nothing else matches. It’s enabled by default and works for any email address.
Managing guest accounts
Guest users appear in your directory with a UserType of “Guest” (vs “Member” for internal users).
Key management tasks:
| Task | How |
|---|---|
| Convert guest to member | Change UserType in user properties |
| Block guest sign-in | Set accountEnabled to false |
| Set expiration | Access reviews or entitlement management (covered in Domain 4) |
| Remove guest | Delete the guest user object |
| Restrict guest permissions | Use external collaboration settings or CA policies |
Scenario: Jake manages freelancer guest access
Coastline Creative works with 15 freelance designers. Jake invites them as guests and:
- Assigns them to a “Freelancers” security group
- Grants group access to the shared design SharePoint site
- Creates a Conditional Access policy: guests must use MFA
- Sets a quarterly access review to clean up stale accounts
When a freelancer’s project ends, the access review catches their inactive account and triggers removal. No orphaned guest accounts cluttering the directory.
External identity providers
By default, guests use their own Entra tenant or email OTP. You can add external identity providers for a smoother sign-in experience:
| Provider | Protocol | Use Case |
|---|---|---|
| OAuth 2.0 / OpenID Connect | Partners with Google Workspace | |
| OAuth 2.0 | Customer-facing B2C apps | |
| SAML/WS-Fed identity provider | SAML 2.0 or WS-Federation | Enterprise partners with non-Microsoft IdPs (Okta, Ping, etc.) |
SAML/WS-Fed federation
For enterprise partners using non-Microsoft identity providers (Okta, Ping Identity, ADFS):
- Configure the partner’s IdP as a SAML or WS-Fed identity provider in your tenant
- Map the partner’s domain to the federation
- When guests from that domain are invited, they authenticate via their own IdP
Exam tip: SAML vs WS-Fed
Both SAML 2.0 and WS-Federation achieve the same goal — federated authentication with external IdPs. The exam may ask which to choose:
- SAML 2.0 — industry standard, works with almost any IdP (Okta, Ping, OneLogin)
- WS-Federation — older Microsoft protocol, primarily for ADFS and legacy Microsoft environments
Default guidance: Use SAML 2.0 unless the partner specifically requires WS-Fed.
🎬 Video walkthrough
Flashcards
Knowledge Check
Anika's client needs to invite 200 consultants from a partner firm that uses Okta as their identity provider. The client wants consultants to sign in with their existing Okta credentials. What should Anika configure?
A guest user from a partner company reports they can't sign in. The partner doesn't have an Entra tenant or Microsoft accounts. What authentication method will Entra use as a fallback?
Next up: Cross-Tenant Access & Synchronisation — control how your tenant trusts and shares with other Entra ID tenants using cross-tenant access settings and sync.