Cross-tenant access
Cross-tenant access settings in Microsoft Entra govern collaboration with other organizations, including inbound and outbound access and whether specified external authentication or device claims are trusted.
Who is coming in, and who is going out?
For a partner using their work account to reach your resources, your tenant applies inbound settings. The partner’s tenant applies outbound settings. Reverse the direction when your staff use their work accounts to visit the partner’s resources.
These controls can target users, groups, and applications. An organization-specific configuration takes precedence over your defaults, so reviewing only the default policy can miss a partner exception.
Trusting a partner’s MFA
Inbound trust lets you accept selected MFA or device claims from the user’s home tenant. For example, a partner who already completed MFA there may satisfy your MFA requirement without another prompt. That trust has to be configured; collaboration being allowed does not make those claims trusted automatically.
Keep tenant restrictions separate. They address someone using an external account from your devices or network. When troubleshooting, start with the account’s home tenant, the resource tenant, and the direction of travel. Then check the policies and sign-in result for that request.