We value your privacy

We use cookies to analyse site traffic and improve your experience. You can accept all cookies or reject non-essential ones. See our Privacy Policy for details.

GR IT SERVICES
  • Contact
Get a quote
  2. Microsoft security
  3. Entra External ID
Microsoft Entra External ID, UAE

The first decision is which tenant the external people live in, and it is very expensive to change later.

A workforce tenant holds your employees and lets business guests in through B2B collaboration. An external tenant is exclusively for apps you publish to consumers and business customers. They differ on single sign-on, on entitlement management and on branding, and building in the wrong one is a migration rather than a setting change.

Book an external identity design sessionSee the two models compared
Microsoft Entra External ID for UAE organisations
  • Two configurationsWorkforce tenant or external tenant
  • No credentials heldGuests authenticate at their home organisation
  • Trust settingsAccept MFA and device claims from partners
  • Monthly active usersThe billing shape for External ID
What it covers

Seven things that decide how external people reach your systems.

Microsoft describes External ID as combining solutions for working with people outside your organisation, where those people bring their own identities, including corporate or government-issued accounts and social identity providers such as Google or Facebook. The differences between the models below are what determine which one you should be building in.

Workforce tenant or external tenant, and they are not interchangeable

A workforce tenant is a standard Entra tenant containing employees, internal business applications and organisational resources, where internal users collaborate with partners and guests through B2B collaboration. An external tenant is exclusively for applications you publish to consumers or business customers, containing app registrations and a directory of customer accounts, separate from your employee directory.

B2B collaboration, where the guest holds no credential with you

Microsoft is precise about this: there are no credentials associated with business guests. They authenticate with their home organisation or identity provider, and your organisation then checks their eligibility for guest collaboration. A user object is created in the same directory as your employees, which you manage like any other, adding it to groups and assigning permissions.

B2B direct connect, which does not create a guest at all

Two-way trust relationships with other Entra organisations that enable Teams Connect shared channels. Users authenticate in their home organisation and receive a token from the resource organisation. Microsoft states that unlike B2B collaboration, direct connect users are not added as guests to your workforce directory, which is a materially different governance position.

Trust settings, so partners are not challenged twice

Microsoft describes trusting multifactor authentication and device compliance claims from an external user home organisation. With trust settings enabled, Entra checks the user credentials for an MFA claim or a device identifier to determine whether the policies were already met, granting seamless sign-on if so, and otherwise initiating a challenge in the user home tenant. That single setting removes most partner friction.

External tenants for consumer and customer-facing applications

Self-service registration flows defining the sign-up steps and permitted sign-in methods, which can include email and password, one-time passcodes, or social accounts from Google or Facebook. Custom branding with your own background images, colours, logos and text across sign-ins. Built-in and custom user attributes collected at sign-up, and analytics on user activity and engagement.

Azure AD B2C is a legacy path, and closed to new customers

Microsoft states that effective 1 May 2025, Azure Active Directory B2C is no longer available for new customers to purchase, and describes it as a legacy solution for customer identity and access management. Any new consumer identity work belongs in an external tenant. Existing B2C estates are a migration conversation rather than a platform to extend.

Cross-tenant settings, which are where the real controls live

Cross-tenant access settings manage collaboration with other Entra organisations and across Microsoft Azure clouds, defining inbound and outbound policies for both B2B collaboration and B2B direct connect. External collaboration settings cover non-Entra external users and organisations. Both are configurable through Microsoft Graph cross-tenant access APIs as well as the portal.

The decision to get right first

Build a customer-facing app in the wrong tenant and single sign-on will not do what you assumed.

The published comparison table is where this becomes concrete, and the single sign-on row is the one that catches product teams.

  • In a workforce tenant, single sign-on to all Microsoft Entra connected applications is supported, which Microsoft illustrates with access to Microsoft 365, on-premises applications and other software as a service such as Salesforce or Workday.
  • In an external tenant, single sign-on to applications registered in that external tenant is supported, and Microsoft states plainly that single sign-on to Microsoft 365 or to other Microsoft software as a service applications is not supported.
  • Entitlement management and Microsoft cloud settings are both listed as supported in workforce tenants and not applicable in external tenants, so the access package model you may already run does not extend to customer accounts.
  • The rule of thumb that holds: if the external people need to reach Microsoft applications and internal resources, they are guests in your workforce tenant. If they are customers of an application you publish, they belong in an external tenant and should never touch your employee directory.
Ask us which model your scenario needs
How we approach it

Four things that keep external access from becoming an unbounded liability.

Inviting a guest takes seconds and is the easiest thing anyone does in Entra. Everything difficult about external identity happens afterwards, and none of it is difficult if it was designed at the start.

We settle the tenant question before anything is built

Workforce tenant for people who need to reach Microsoft applications and internal resources. External tenant for customers of an application you publish, where single sign-on to Microsoft 365 is explicitly not supported and entitlement management does not apply. Getting this wrong is a migration, not a reconfiguration, and product teams discover it late.

We turn on trust settings so security does not create friction

Where Conditional Access requires multifactor authentication or device compliance, trusting the claim from a partner home organisation means the partner is not challenged twice for something they have already satisfied. Microsoft describes exactly this mechanism, and it is consistently the change that makes partners stop complaining about your security.

We govern guests with packages and reviews, not invitations

Microsoft points to entitlement management for managing identity and access for external users at scale, where approved requesters are provisioned with guest accounts and assigned to groups, applications and SharePoint sites, and where assignments expire. Combined with access reviews, that turns guest access from a permanent grant into a governed one.

We treat B2B direct connect as a different governance question

Direct connect users are not added as guests to your workforce directory, which means they will not appear in the guest list somebody reviews and will not be caught by a guest access review. That is fine if you know it and a genuine blind spot if you do not, so shared channel relationships get their own inventory and owner.

Where this matters most

Six UAE situations that force the external identity question.

Microsoft frames External ID around two audiences: businesses seeking secure B2B collaboration, and application developers who need authentication and customer identity and access management.

A firm collaborating with clients and subcontractors daily

Guests in the workforce tenant, using their own corporate credentials with no password held by you, added to the groups and Teams they need. The value comes from doing it through access packages with an expiry rather than through individual invitations, because otherwise the guest list only ever grows.

A business launching a customer-facing application

An external tenant, with self-service registration flows, sign-in by email and password, one-time passcodes or social accounts, custom branding per application, and analytics on user activity. Crucially, customer accounts stay out of the employee directory entirely, which is both a security and a licensing consideration.

A regulated firm that cannot weaken its access controls for partners

Conditional Access policies apply to external B2B collaboration and direct connect users in the same way as to employees. Trust settings then let you accept a multifactor authentication claim or device identifier from the partner home tenant where those policies were already satisfied, which keeps the control without the double prompt.

An operator working in Teams shared channels with suppliers

B2B direct connect creates two-way trust with the supplier Entra organisation, enabling Teams Connect shared channels for chat, calls, file sharing and application sharing. Users access the shared channel without switching organisations or signing in with a different account, and they are not added as guests to your directory.

A group that has grown into several Entra tenants

Multitenant organisation capability enables collaboration across Microsoft 365 for an organisation with more than one Entra instance, and cross-tenant synchronisation is a one-way service that lets users access resources without receiving an invitation email or accepting a consent prompt in each tenant. For UAE groups after acquisitions, that is usually a better fit than treating colleagues as guests.

An organisation still running Azure AD B2C

Microsoft states that effective 1 May 2025 Azure AD B2C is no longer available for new customers to purchase, and describes it as legacy. Existing estates keep working, but new consumer identity work belongs in an external tenant, and the question of when and how to move is one worth answering deliberately rather than by drift.

Three positions

How UAE organisations let outsiders in today.

The middle column is nearly universal. Guests were invited one at a time by whoever needed them, the invitations worked, and nothing has ever removed one.
External people use their own identity
Designed external identity modelYes
Ad hoc guest invitationsYes
Shared accounts and workaroundsNo
Access granted through a defined process
Designed external identity modelYes
Ad hoc guest invitationsNo
Shared accounts and workaroundsNo
Partner MFA claims trusted
Designed external identity modelYes
Ad hoc guest invitationsRarely
Shared accounts and workaroundsNot applicable
Conditional Access applied to guests
Designed external identity modelYes
Ad hoc guest invitationsSometimes
Shared accounts and workaroundsNo
Access expires without intervention
Designed external identity modelYes
Ad hoc guest invitationsNo
Shared accounts and workaroundsNo
Guests reviewed on a schedule
Designed external identity modelYes
Ad hoc guest invitationsNo
Shared accounts and workaroundsNot applicable
Customer accounts kept out of the employee directory
Designed external identity modelYes
Ad hoc guest invitationsNot applicable
Shared accounts and workaroundsNo
Partner relationships have a named owner
Designed external identity modelYes
Ad hoc guest invitationsNo
Shared accounts and workaroundsNo
Cross-tenant policy set deliberately
Designed external identity modelYes
Ad hoc guest invitationsDefault
Shared accounts and workaroundsDefault
Answerable question: who has access?
Designed external identity modelYes
Ad hoc guest invitationsNo
Shared accounts and workaroundsNo
Feature
Designed external identity model
Ad hoc guest invitations
Shared accounts and workarounds
External people use their own identity
YesYesNo
Access granted through a defined process
YesNoNo
Partner MFA claims trusted
YesRarelyNot applicable
Conditional Access applied to guests
YesSometimesNo
Access expires without intervention
YesNoNo
Guests reviewed on a schedule
YesNoNot applicable
Customer accounts kept out of the employee directory
YesNot applicableNo
Partner relationships have a named owner
YesNoNo
Cross-tenant policy set deliberately
YesDefaultDefault
Answerable question: who has access?
YesNoNo
The two models

Workforce tenant against external tenant, on the points that matter.

Reproduced from the published comparison. The distinctions in the lower half are the ones that determine whether a design is viable.
AspectExternal ID in workforce tenantsExternal ID in external tenants
Primary scenarioYour workforce collaborates with business guests, who use their preferred identities to sign in to resources in your organisationYou publish applications to external consumers and business customers, using External ID for identity experiences
Intended forBusiness partners from external organisations such as suppliers, partners and vendorsConsumers and business customers of your application
Where users are managedIn the same workforce tenant as employees, typically annotated as guest usersIn an external tenant separate from the employee directory, with different default permissions
Single sign-onTo all Microsoft Entra connected applications, including Microsoft 365, on-premises and SaaS applicationsTo applications registered in the external tenant only, not to Microsoft 365 or other Microsoft SaaS
BrandingMicrosoft design by default, customisable with your company brandingNeutral by default with no Microsoft branding, customisable per organisation or per application
Entitlement managementSupportedNot applicable
Microsoft cloud settingsSupportedNot applicable
Typical exampleInvite a guest to sign in to your Microsoft applications, or become a guest member in TeamsA customised sign-in experience for users of your consumer mobile application, with usage monitored
How an engagement runs

Five steps, and step one determines the cost of everything after it.

Typically six to twelve weeks depending on whether an external tenant and application work is in scope. The identity design is the fast part. Agreeing governance of guests is what takes the calendar.
  1. 1

    Choose the tenant configuration per scenario

    Workforce tenant for partners, suppliers and vendors who need to reach your Microsoft applications and internal resources. External tenant for consumers and business customers of an application you publish. We map each population explicitly, because organisations frequently have both and treat them as one problem.

  2. 2

    Design cross-tenant access settings

    Inbound and outbound policies for B2B collaboration and B2B direct connect, defined per partner organisation rather than left at the default. Whether to trust multifactor authentication and device compliance claims from each partner home tenant. External collaboration settings for non-Entra organisations and identity providers.

  3. 3

    Put guest access inside a governed process

    Entitlement management access packages so partners request access, a named approver decides, and the assignment expires. Microsoft describes approved users being provisioned with guest accounts and assigned to groups, applications and SharePoint sites. Access reviews attached so recertification happens in the same model.

  4. 4

    Apply Conditional Access to external users deliberately

    Guests are subject to the same policy framework as employees, which is a strength rather than a complication. Trust settings are configured where a partner has already met the requirement, so the control holds without a second challenge, and the exception list is documented rather than assumed.

  5. 5

    Build the external tenant work if it is in scope

    Self-service registration flows, sign-in methods including one-time passcodes and social identity providers where appropriate, branding per application, user attributes collected at sign-up, and the second-factor decision between email one-time passcode and SMS-based authentication. Automation through Microsoft Graph where the identity flows need to be repeatable.

Straight answers

What organisations ask about Entra External ID.

A workforce tenant is a standard Entra tenant containing your employees, internal business applications and organisational resources, where B2B collaboration lets your people work with external partners and guests. An external tenant is exclusively for applications you publish to consumers or business customers, containing your app registrations and a directory of customer accounts, separate from the employee directory.

If the external people need to reach Microsoft applications or internal resources, they belong in your workforce tenant as guests. If they are customers of an application you publish, they belong in an external tenant. The decisive detail is single sign-on: workforce tenants support it to all Entra connected applications, external tenants only to applications registered in that tenant, and explicitly not to Microsoft 365.

No. Microsoft states there are no credentials associated with business guests. They authenticate with their home organisation or identity provider, and your organisation then checks their eligibility for guest collaboration. A user object is created in your directory so you can manage permissions and group membership, but the credential remains theirs and stays with them.

It creates two-way trust with another Entra organisation to enable Teams Connect shared channels, where users authenticate in their home organisation and receive a token from the resource organisation. Microsoft states that unlike B2B collaboration, direct connect users are not added as guests to your workforce directory, which means they will not appear in a guest inventory or a guest access review.

Yes. Microsoft states organisations can enforce Conditional Access policies for external B2B collaboration and B2B direct connect users in the same way as for full-time employees and members. There is also a mechanism worth using: trusting multifactor authentication and device compliance claims from an external user home organisation, so a partner who has already met the requirement is not challenged again.

Microsoft describes it precisely. When trust settings are enabled, during authentication Entra checks the user credentials for a multifactor authentication claim or a device identifier to determine whether the policies were already met. If so, the external user gets seamless sign-on to your shared resource. If not, a multifactor authentication or device challenge is initiated in the user home tenant rather than yours.

Entitlement management. Microsoft points to it directly for managing identity and access for external users at scale, automating access request workflows, assignments, reviews and expiration. On approval users are provisioned with guest accounts and assigned to groups, applications and SharePoint Online sites, and the assignment carries an expiry. Access reviews then recertify what remains.

Microsoft names corporate or government-issued accounts and social identity providers such as Google or Facebook. In B2B collaboration you can invite users with Entra accounts, Microsoft accounts or social identities you enable. In external tenants the sign-in methods you allow are defined in the self-service registration flow, and can include email and password, one-time passcodes, or social accounts.

Not for new work. Microsoft states that effective 1 May 2025, Azure AD B2C is no longer available for new customers to purchase, and describes it as a legacy solution for customer identity and access management. Existing tenants keep operating, but new consumer identity work belongs in an external tenant, and any existing B2C estate should have a deliberate plan rather than an assumption.

In external tenants, Microsoft names two second-factor methods: email one-time passcode, where the user is prompted for a passcode sent to their email after signing in, and SMS-based authentication, available for users who sign in with email and password, email and one-time passcode, or social identities such as Google or Facebook. Both are configured through a Conditional Access policy and the sign-up and sign-in user flows.

Microsoft states that licensing and billing are based on monthly active users. That is a different shape from per-seat licensing and it changes how you forecast, because the cost follows how many external people actually sign in rather than how many exist in the directory. We size it against your expected usage rather than publishing a rate that may change.

Almost all of it. Microsoft states all External ID features are supported for automation through Microsoft Graph APIs, with one documented exception around identifying which organisations you belong to, which has named workarounds. Cross-tenant access APIs create the same B2B collaboration and direct connect policies configurable in the portal, and the invitation management resource lets you build your own onboarding experience.

That is a different feature. Multitenant organisation capability is designed for an organisation with more than one Entra instance, enabling seamless collaboration across Microsoft 365 in applications such as Teams and Viva Engage. Cross-tenant synchronisation is a one-way service letting users access resources without receiving an invitation email or accepting a consent prompt in each tenant. For UAE groups after acquisitions this usually fits better than guest invitations.

Yes, through two routes. Self-service sign-up user flows let guests sign up for applications themselves, with the experience customised to allow sign-up with a work, school or social identity and to collect information during sign-up. Or entitlement management, where you configure policies that let users from other organisations request access and be provisioned on approval, which is the more governed of the two.

We scope per organisation, driven by whether external tenant and application work is in scope, how many partner organisations need cross-tenant settings, and whether guest access is being brought into entitlement management as part of the same project. The tenant configuration decision comes first and is quick, and it is worth taking before any development begins.
Designing the model

Fifteen questions that keep external access governed.

The first group picks the model, the second sets the controls, and the third is the half that is almost always missing: what happens when the relationship ends.

Which model

  • Do they need Microsoft 365 access?
    Then they are guests in the workforce tenant.
  • Are they customers of an app you publish?
    Then an external tenant.
  • Is Teams shared channel collaboration the need?
    That is B2B direct connect.
  • Do you have an existing Azure AD B2C estate?
    Closed to new customers since 1 May 2025.
  • Are you multi-tenant internally?
    Cross-tenant synchronisation may fit better.

Controls

  • Are cross-tenant access settings configured?
    Inbound and outbound, per organisation.
  • Do you trust partner MFA claims?
    It removes double challenges.
  • Do you trust partner device compliance?
    Same mechanism, higher bar.
  • Which identity providers are permitted?
    Corporate, government-issued, or social.
  • Is Conditional Access applied to guests?
    It can be, exactly as for employees.

Ending access

  • Who removes a guest when a project ends?
    Usually nobody, which is the problem.
  • Are access packages governing guest access?
    Entitlement management handles expiry.
  • Are guests reviewed on a schedule?
    Access reviews cover them explicitly.
  • Do direct connect users appear anywhere?
    They are not guests in your directory.
  • Who owns each partner relationship?
    A connected organisation needs an owner.
Related reading

The pages around this one.

Entra entitlement management

How partner access gets requested, approved and expired rather than invited.

Learn more

Entra access reviews

Recertifying guests, which lifecycle workflows do not cover.

Learn more

Conditional Access

The policy framework that applies to external users the same way it applies to employees.

Learn more
Next step

Count your guest accounts, then count the ones anybody could justify.

The gap between those two numbers is the reason to design this rather than continue inviting one at a time. It is also a number that only grows until somebody puts a process around it.

Book an external identity design sessionCall +971 56 613 2743

Related Services

Explore more solutions that work great with this service

Entra Entitlement Management

Access packages that expire on their own

Learn more

Entra Access Reviews

Recurring recertification of groups, apps and roles

Learn more

Entra Conditional Access

The control that decides who reaches your data

Learn more

Entra ID Governance

Joiner mover leaver, access packages and guests that expire on their own

Learn more

Microsoft Entra

Identity and access management solutions

Learn more

SSO Solutions

Single sign-on across all SaaS apps

Learn more

Microsoft Security Dubai

Entra, Defender, Purview, Sentinel, and what you already own

Learn more

Entra Verified ID

Portable credentials verified without calling you

Learn more
GR IT SERVICES

Leading IT services provider in Dubai,
delivering enterprise-grade solutions
for businesses across the UAE.

Microsoft CSP PartnerCISGuard

Get the Helpdesk app

Raise and track IT tickets from your phone.

Download on the App StoreGet it on Google Play
Learn more about the app

Microsoft 365

  • Microsoft 365 Administration
  • M365 Reporting & Auditing
  • Microsoft 365 Licensing
  • Microsoft Copilot
  • Microsoft 365 Apps
  • Windows 365 Cloud PC
  • Microsoft SharePoint
  • Outlook & Exchange

Security

  • Microsoft Defender
  • Microsoft Purview
  • Microsoft Intune
  • Microsoft Entra
  • Compliance Manager
  • Cybersecurity Audits
  • Copilot for Security
  • Microsoft Sentinel
  • Microsoft Priva

Infrastructure

  • Google Workspace
  • Cloud Migration Services
  • Data Analytics & BI
  • Active Directory
  • Server Management
  • Apple Business
  • Apple Jamf Pro
  • IP Telephone
  • Data Backup
  • Website Development

IT Services

  • Managed IT Services
  • IT Support Dubai
  • IT AMC Dubai
  • New Office IT Setup
  • IT Relocation
  • Remote IT Support
  • On-Call IT Support
  • Startup IT Business Kit
  • Disaster Recovery & BC

Company

  • About Us
  • Careers
  • Contact
  • Blog

Contact

  • Iris Bay Tower, Office 903,
    Business Bay, Dubai, UAE
  • +971 56 613 2743
  • hello@gritservices.ae
  • gritservices.ae

© 2026 GR IT Services. All rights reserved.

Privacy PolicyTerms of UseCookie Policy