Tenant restrictions
Tenant restrictions are Microsoft Entra controls for limiting access to external organizations using external identities from environments where the restriction is enforced.
A work laptop can still use somebody else’s account
An employee signs in to a partner’s application with an account issued by that partner. Your outbound collaboration policy for employee accounts does not answer whether that external account should be allowed. Tenant restrictions address this gap.
The distinction is the identity being used. Cross-tenant access outbound settings govern your organizational identities visiting other tenants. Tenant restrictions govern external identities used from an environment where you enforce the restriction.
A policy needs an enforcement path
Creating the policy is only part of deployment. Microsoft documents enforcement through Global Secure Access, a corporate proxy, or supported Windows device configuration. Coverage differs between those methods.
Authentication-plane protection controls sign-ins. Data-plane protection, which Microsoft lists as preview, covers supported resource requests that could otherwise avoid those sign-in checks, including some uses of imported tokens. A proxy that adds tenant-restriction headers only at authentication does not provide data-plane protection.
Test an allowed partner account and a blocked external account from the actual devices and connections in scope. Also check the service-specific limitations; this is not a blanket control over every external website.