You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/external-id/authentication-conditional-access.md
+7-7Lines changed: 7 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -33,7 +33,7 @@ This article describes the authentication flow for external users who are access
33
33
34
34
The following diagram illustrates the authentication flow when a Microsoft Entra organization shares resources with users from other Microsoft Entra organizations. This diagram shows how cross-tenant access settings work with Conditional Access policies, such as multifactor authentication, to determine if the user can access resources. This flow applies to both B2B collaboration and B2B direct connect, except as noted in step 6.
35
35
36
-
[](media/authentication-conditional-access/cross-tenant-auth.png#lightbox)
36
+
[](media/authentication-conditional-access/cross-tenant-auth.png#lightbox)
37
37
38
38
|Step |Description |
39
39
|---------|---------|
@@ -54,26 +54,26 @@ When a Microsoft Entra organization shares resources with external users with an
54
54
55
55
The following diagram illustrates the authentication flow when an external user signs in with an account from a non-Microsoft Entra ID identity provider, such as Google, Facebook, or a federated SAML/WS-Fed identity provider.
56
56
57
-
[](media/authentication-conditional-access/authentication-flow-b2b-guests.png#lightbox)
57
+
[](media/authentication-conditional-access/authentication-flow-b2b-guests.png#lightbox)
58
58
59
59
| Step | Description |
60
60
|--------------|-----------------------|
61
61
|**1**| The B2B guest user requests access to a resource. The resource redirects the user to its resource tenant, a trusted IdP.|
62
-
| **2** | The resource tenant identifies the user as external and redirects the user to the B2B guest user’s IdP. The user performs primary authentication in the IdP.
63
-
| **3** | Authorization policies are evaluated in the B2B guest user's IdP. If the user satisfies these policies, the B2B guest user's IdP issues a token to the user. The user is redirected back to the resource tenant with the token. The resource tenant validates the token and then evaluates the user against its Conditional Access policies. For example, the resource tenant could require the user to perform Microsoft Entra multifactor authentication.
64
-
| **4** | Inbound cross-tenant access settings and Conditional Access policies are evaluated. If all policies are satisfied, the resource tenant issues its own token and redirects the user to its resource.
62
+
|**2**| The resource tenant identifies the user as external and redirects the user to the B2B guest user’s IdP. The user performs primary authentication in the IdP.|
63
+
|**3**| Authorization policies are evaluated in the B2B guest user's IdP. If the user satisfies these policies, the B2B guest user's IdP issues a token to the user. The user is redirected back to the resource tenant with the token. The resource tenant validates the token and then evaluates the user against its Conditional Access policies. For example, the resource tenant could require the user to perform Microsoft Entra multifactor authentication.|
64
+
|**4**| Inbound cross-tenant access settings and Conditional Access policies are evaluated. If all policies are satisfied, the resource tenant issues its own token and redirects the user to its resource.|
65
65
66
66
### Example 2: Authentication flow and token for one-time passcode user
67
67
68
68
The following diagram illustrates the flow when email one-time passcode authentication is enabled and the external user isn't authenticated through other means, such as Microsoft Entra ID, Microsoft account (MSA), or social identity provider.
69
69
70
-
[](media/authentication-conditional-access/authentication-flow-b2b-guests-otp.png#lightbox)
70
+
[](media/authentication-conditional-access/authentication-flow-b2b-guests-otp.png#lightbox)
71
71
72
72
| Step | Description |
73
73
|--------------|-----------------------|
74
74
|**1**|The user requests access to a resource in another tenant. The resource redirects the user to its resource tenant, a trusted IdP.|
75
75
|**2**| The resource tenant identifies the user as an external email one-time passcode (OTP) user and sends an email with the OTP to the user.|
76
-
| **3** | The user retrieves the OTP and submits the code. The resource tenant evaluates the user against its Conditional Access policies.
76
+
|**3**| The user retrieves the OTP and submits the code. The resource tenant evaluates the user against its Conditional Access policies.|
77
77
|**4**| Once all Conditional Access policies are satisfied, the resource tenant issues a token and redirects the user to its resource. |
Copy file name to clipboardExpand all lines: docs/external-id/customers/tutorial-configure-cloudflare-integration.md
+4-4Lines changed: 4 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -47,12 +47,12 @@ Enable WAF for a domain.
47
47
48
48
1. In the DNS console, for CNAME, enable the proxy setting.
49
49
50
-
[](media/tutorial-configure-cloudflare-integration/proxy-settings-expanded.png#lightbox)
50
+
[](media/tutorial-configure-cloudflare-integration/proxy-settings-expanded.png#lightbox)
51
51
52
52
2. Under DNS, for **Proxy status**, select **Proxied**.
53
53
3. The status turns orange.
54
54
55
-
[](media/tutorial-configure-cloudflare-integration/proxied-status-expanded.png#lightbox)
55
+
[](media/tutorial-configure-cloudflare-integration/proxied-status-expanded.png#lightbox)
56
56
57
57
## Cloudflare security controls
58
58
@@ -65,7 +65,7 @@ For optimal protection, we recommend you enable Cloudflare security controls.
65
65
3. Select **DDoS**.
66
66
4. A message appears.
67
67
68
-
[](media/tutorial-configure-cloudflare-integration/ddos-message-expanded.png#lightbox)
68
+
[](media/tutorial-configure-cloudflare-integration/ddos-message-expanded.png#lightbox)
69
69
70
70
### Bot protection
71
71
@@ -134,7 +134,7 @@ For the following instructions, you can add custom HTML pages for visitors.
134
134
2. For **Cloudflare Managed Ruleset**, select **Enabled**.
135
135
3. For **Cloudflare OWASP Core Ruleset**, select **Enabled**.
136
136
137
-
[](media/tutorial-configure-cloudflare-integration/ruleset-expanded.png#lightbox)
137
+
[](media/tutorial-configure-cloudflare-integration/ruleset-expanded.png#lightbox)
Copy file name to clipboardExpand all lines: docs/external-id/tenant-restrictions-migration.md
+6-6Lines changed: 6 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -69,15 +69,15 @@ Allow internal identities, such as employees, to access specific external tenant
69
69
1. In **Cross-tenant access settings**, [add each domain/tenant as an organization under Organizational settings](cross-tenant-access-settings-b2b-collaboration.yml#add-an-organization).
70
70
2. To allow all users and groups and allow all applications, for each added organization, [configure outbound access for B2B collaboration](cross-tenant-access-settings-b2b-collaboration.yml#modify-outbound-access-settings).
71
71
72
-
[](media/tenant-restrictions-migration/organizational-settings.png#lightbox)
72
+
[](media/tenant-restrictions-migration/organizational-settings.png#lightbox)
73
73
74
74
3. To block all users and groups and all applications for B2B collaboration, [configure the default cross-tenant access outbound settings](cross-tenant-access-settings-b2b-collaboration.yml#configure-default-settings). This action applies only to tenants not added in [step 1](#allow-only-internal-identities-access-to-specific-external-tenants).
75
75
76
-
[](media/tenant-restrictions-migration/default-settings.png#lightbox)
76
+
[](media/tenant-restrictions-migration/default-settings.png#lightbox)
77
77
78
78
4. In **Tenant restrictions** defaults, create the policy ID (if not created) and [configure the policy to block all users, groups, and external applications](tenant-restrictions-v2.md#configure-server-side-tenant-restrictions-v2-cloud-policy). This action applies only to tenants not added in [step 1](#allow-only-internal-identities-access-to-specific-external-tenants).
79
79
80
-
[](media/tenant-restrictions-migration/tenant-restrictions-default.png#lightbox)
80
+
[](media/tenant-restrictions-migration/tenant-restrictions-default.png#lightbox)
81
81
82
82
### Allow internal and external identities to access specific external tenants
83
83
@@ -87,15 +87,15 @@ Allow internal identities such as employees, and external identities such as con
87
87
2. For each added organization to enable internal identities, [configure Outbound access for B2B collaboration](cross-tenant-access-settings-b2b-collaboration.yml#modify-outbound-access-settings) to allow all users, groups, and applications.
88
88
3. For each added organization to enable external identities, [configure the organization tenant restrictions](tenant-restrictions-v2.md#step-2-configure-tenant-restrictions-v2-for-specific-partners) to allow all users, groups, and applications.
89
89
90
-
[](media/tenant-restrictions-migration/organizational-settings-outbound.png#lightbox)
90
+
[](media/tenant-restrictions-migration/organizational-settings-outbound.png#lightbox)
91
91
92
92
4. To block all users, groups, and applications for B2B collaboration, [configure the default Cross Tenant Access outbound access settings](cross-tenant-access-settings-b2b-collaboration.yml#configure-default-settings). This action applies only to tenants not added in [step 1](#allow-internal-and-external-identities-to-access-specific-external-tenants).
93
93
94
-
[](media/tenant-restrictions-migration/default-settings-outbound.png#lightbox)
94
+
[](media/tenant-restrictions-migration/default-settings-outbound.png#lightbox)
95
95
96
96
5. In **Tenant restrictions defaults**, [create the policy ID (if not created) and configure the policy to block all users, groups, and external applications](tenant-restrictions-v2.md#configure-server-side-tenant-restrictions-v2-cloud-policy). This action applies only to tenants not added in [step 1](#allow-internal-and-external-identities-to-access-specific-external-tenants).
97
97
98
-
[](media/tenant-restrictions-migration/tenant-restrictions-applies.png#lightbox)
98
+
[](media/tenant-restrictions-migration/tenant-restrictions-applies.png#lightbox)
99
99
100
100
> [!NOTE]
101
101
> To target consumer Microsoft accounts (MSAs), add an organization with the following tenant ID: 9188040d-6c67-4c5b-b112-36a304b66dad.
-`TenantID` is your Microsoft Entra tenant ID. Find this value by signing in to the [Microsoft Entra admin center](https://entra.microsoft.com) as an administrator and browsing to **Identity** > **Overview** and selecting the **Overview** tab.
348
348
-`policyGUID` is the object ID for your cross-tenant access policy. Find this value by calling `/crosstenantaccesspolicy/default` and using the “id” field returned.
0 commit comments