Setting up Entra ID B2B Collaboration

Setting Up Azure Entra ID B2B Collaboration – A Detailed, Fact‑Based Guide

---

1. Prerequisites & Planning

Item	Why It Matters
Azure Entra ID tenant (the “host” tenant)	All B2B relationships are anchored in a single tenant that you control.
Appropriate licensing	Azure AD Premium P1 (or higher) is required for most B2B features such as conditional access policies, entitlement management, and advanced security reporting.
External partner identification	Know the domains, user types (guest vs. member), and the level of access each partner needs.
Governance policy	Define who can invite guests, what resources they may access, and any compliance constraints (e.g., data residency).
Conditional Access strategy	Decide whether you’ll require MFA, device compliance, or location restrictions for guest sign‑ins.

---

2. Enable External Collaboration Settings

1. Navigate to Azure portal → Azure Entra ID → External Identities → External collaboration settings.
2. Set “Guest user permissions are limited by default” to Yes if you want guests to start with minimal rights.
3. Configure “Invitation redemption” – allow guests to redeem invitations via email or direct link.
4. Restrict allowed domains (optional) – under “Domain restrictions”, specify which external domains may be invited, useful for whitelisting trusted partners.

Why: These settings establish the baseline security posture for all incoming B2B accounts.

---

3. Invite Guest Users

3.1 Manual Invitation (Portal)

1. Azure Entra ID → Users → New guest user → Invite user.
2. Fill in:
   • Email address of the external user.
   • Display name (optional).
   • Message (optional, but helps with context).
3. Select “Send invitation”. The guest receives an email with a redemption link.

3.2 Bulk Invitation (CSV)

1. Prepare a CSV file with columns UserPrincipalName, DisplayName, InviteRedirectUrl.
2. In Azure Entra ID → Users → Bulk create, upload the CSV.
3. Review the import summary and confirm.

Tip: Use the bulk method for onboarding dozens or hundreds of partners at once.

3.3 Programmatic Invitation (Microsoft Graph)

POST https://graph.microsoft.com/v1.0/invitations
Content-Type: application/json
Authorization: Bearer <access_token>

{
  "invitedUserEmailAddress": "partner@example.com",
  "inviteRedirectUrl": "https://myapp.example.com",
  "sendInvitationMessage": true,
  "invitedUserMessageInfo": {
    "customizedMessageBody": "Welcome to our Azure environment – please accept the invitation."
  }
}

• Requires Application permission User.Invite.All.
• Automates invitation flows for SaaS platforms or custom provisioning pipelines.

---

4. Assign Access to Resources

1. Create Azure AD groups (security or Microsoft 365) that represent logical permission sets (e.g., “Partner‑Finance‑Read”).
2. Add guest users to the appropriate groups.
3. Assign group memberships to Azure resources:
   • Azure RBAC – assign built‑in roles (Reader, Contributor, etc.) at subscription, resource group, or resource scope.
   • Microsoft 365 – grant SharePoint site, Teams channel, or Exchange mailbox access via the same groups.

Best practice: Keep guest permissions principle‑of‑least‑privilege; use groups to simplify future changes.

---

5. Conditional Access for Guests

1. Azure Entra ID → Security → Conditional Access → New policy.
2. Assignments → Users or workload identities → Select “Guest or external users”.
3. Cloud apps or actions → Choose the apps you want to protect (e.g., Azure Portal, Office 365).
4. Conditions → Locations / Device state – optionally block sign‑ins from high‑risk locations.
5. Grant → Require multi‑factor authentication (MFA) and/or Require compliant device.
6. Enable policy after testing with a pilot guest account.

Why: Conditional Access mitigates the risk of compromised guest credentials by enforcing additional verification steps.

---

6. Entitlement Management (Optional Advanced Governance)

• Azure Entra ID → Identity Governance → Entitlement Management → Catalogs → New catalog.
• Define access packages that bundle resource permissions, approval workflows, and expiration rules.
• Guests request access via a self‑service portal; administrators approve according to policy.

Benefit: Automates lifecycle management (request, approval, review, removal) for large partner ecosystems.

---

7. Monitoring & Auditing

Feature	What to Look For
Sign‑in logs (Azure Entra ID → Sign‑ins)	Unusual locations, repeated failures, MFA challenges.
Audit logs (Azure Entra ID → Audit logs)	Guest creation, role assignments, policy changes.
Access reviews (Identity Governance)	Periodic validation that guests still need their assigned permissions.
Azure AD Identity Protection	Risk detections on guest accounts (e.g., leaked credentials).

• Export logs to Log Analytics or Microsoft Sentinel for long‑term retention and correlation with other security events.

---

8. Licensing & Cost Considerations

License	Guest‑related Benefits
Azure AD Free	Basic B2B invitation, limited to 50,000 guest objects.
Azure AD Premium P1	Conditional Access, entitlement management, access reviews, identity protection.
Azure AD Premium P2	Advanced risk detection, privileged identity management for guests.

• Guest users do not consume paid licenses unless you assign them to premium features (e.g., Azure AD P2 risk policies).
• Monitor guest count to stay within free tier limits if you are on the free license.

---

9. Common Pitfalls & Mitigations

Pitfall	Mitigation
Guests retain excessive rights after project ends	Implement automated access reviews and set expiration dates on access packages.
MFA not enforced for guests	Explicitly include “Guest or external users” in Conditional Access policies that require MFA.
Domain restriction misconfiguration blocks legitimate partners	Test domain whitelist with a pilot guest before applying globally.
Invitation emails land in spam	Advise partners to whitelist @microsoft.com domains or use direct invitation links via secure portals.
Licensing overspend	Regularly audit guest counts; move inactive guests to a “Disabled” state to keep the directory tidy.