Enable B2B collaboration across Azure clouds

Applies to: Workforce tenants External tenants (learn more)

When Microsoft Entra organizations in separate Azure clouds need to collaborate, they can use Microsoft cloud settings to enable Microsoft Entra B2B collaboration with each other. B2B collaboration is available between the following global and sovereign Azure clouds:

• Microsoft Azure commercial cloud and Microsoft Azure Government
• Microsoft Azure commercial cloud and Microsoft Azure operated by 21Vianet

To enable collaboration between two organizations in different Azure clouds, an admin in each organization completes the following steps:

1. Configures their Microsoft cloud settings to enable collaboration with the partner's cloud.

2. Uses the partner's tenant ID to find and add the partner to their organizational settings.

3. Configures their inbound and outbound settings for the partner organization. The admin can either apply the default settings or configure specific settings for the partner.

After each organization completes these steps, Microsoft Entra B2B collaboration between the organizations is enabled.

Before you begin

• Obtain the partner's tenant ID. To enable B2B collaboration with a partner's Microsoft Entra organization in another Azure cloud, you need the partner's tenant ID. Using an organization's domain name for lookup isn't available in cross-cloud scenarios.
• Decide on inbound and outbound access settings for the partner. Selecting a cloud in your Microsoft cloud settings doesn't automatically enable B2B collaboration. Once you enable another Azure cloud, all B2B collaboration is blocked by default for organizations in that cloud. You need to add the tenant you want to collaborate with to your Organizational settings. At that point, your default settings go into effect for that tenant only. You can allow the default settings to remain in effect. Or, you can modify the inbound and outbound settings for the organization.
• Obtain any required object IDs or app IDs. If you want to apply access settings to specific users, groups, or applications in the partner organization, you need to contact the organization for information before configuring your settings. Obtain their user object IDs, group object IDs, or application IDs (client app IDs or resource app IDs) so you can target your settings correctly.

Enable the cloud in your Microsoft cloud settings

In your Microsoft cloud settings, enable the Azure cloud you want to collaborate with.

1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.

2. Browse to Identity > External Identities > Cross-tenant access settings, then select Microsoft cloud settings.

3. Select the checkboxes next to the external Azure clouds you want to enable.

   

Add the tenant to your organizational settings

Follow these steps to add the tenant you want to collaborate with to your Organizational settings.

1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.

2. Browse to Identity > External Identities > Cross-tenant access settings, then select Organizational settings.

3. Select Add organization.

4. On the Add organization pane, type the tenant ID for the organization (cross-cloud lookup by domain name isn't currently available).

   

5. Select the organization in the search results, and then select Add.

6. The organization appears in the Organizational settings list. At this point, all access settings for this organization are inherited from your default settings.

   

7. If you want to change the cross-tenant access settings for this organization, select the Inherited from default link under the Inbound access or Outbound access column. Then follow the detailed steps in these sections:

   • Modify inbound access settings
   • Modify outbound access settings

Sign-in endpoints

After you enable collaboration with an organization from a different Azure cloud, cross-cloud Microsoft Entra guest users can now sign in to your multitenant or Microsoft first-party apps by using a common endpoint (in other words, a general app URL that doesn't include your tenant context). During the sign-in process, the guest user chooses Sign-in options, and then selects Sign in to an organization. The user then types the name of your organization and continues signing in using their Microsoft Entra credentials.

Cross-cloud Microsoft Entra guest users can also use application endpoints that include your tenant information, for example:

• https://myapplications.windowsazure.cn/?tenantid=<your tenant ID>
• https://myapplications.windowsazure.cn/<your verified domain>.partner.onmschina.cn
• https://contoso.sharepoint.com/sites/testsite

You can also give cross-cloud Microsoft Entra guest users a direct link to an application or resource by including your tenant information, for example https://myapplications.windowsazure.cn/signin/X/<application ID?tenantId=<your tenant ID>.

Supported scenarios with cross-cloud Microsoft Entra guest users

The following scenarios are supported when collaborating with an organization from a different Azure cloud:

• Use B2B collaboration to invite a user in the partner tenant to access resources in your organization, including web line-of-business apps, SaaS apps, and SharePoint Online sites, documents, and files.
• Use B2B collaboration to share Power BI content to a user in the partner tenant.
• Apply Conditional Access policies to the B2B collaboration user and opt to trust multifactor authentication or device claims (compliant claims and Microsoft Entra hybrid joined claims) from the user’s home tenant.

Next steps

See Configure external collaboration settings for B2B collaboration with non Microsoft Entra identities, social identities, and non-IT managed external accounts.