Set up B2B direct connect for Teams shared channels between two tenants

Teams shared channels between two organisations run on Microsoft Entra B2B direct connect. It is off by default, and it only works when both tenants allow it: the tenant that hosts the channel allows inbound access, the other tenant allows outbound access. This guide walks through both sides, in the portal and in PowerShell, with a check afterwards, the errors we see most, and how to undo it.

What the connection means for security, compliance and records management, and what each organisation can see of the other, is in our blog Shared channels between two tenants: how to set it up, and what it means. Read that first if you still have to decide.

Before you start

• Roles: Security Administrator (minimum) in Entra in both tenants. Teams Administrator for the Teams steps. A Teams Administrator can read the cross-tenant settings but not change them.
• Licence: Microsoft Entra ID P1 to limit access to specific groups or applications. Without P1 you can only allow or block everyone.
• Accounts: external participants need a work or school account in Entra ID. Guests can’t be added to a shared channel.
• Same cloud: both tenants in the same Microsoft cloud. Cross-cloud (for example commercial and a US government cloud) needs the Microsoft cloud settings in cross-tenant access first.

Exchange these details with the other organisation before you open a portal:

Step 1: Create a group for the participants (both tenants)

Create a security group in each tenant with only the people who work with the other organisation, for example SG-SharedChannels-Fabrikam at Contoso and SG-SharedChannels-Contoso at Fabrikam. Send the object ID of your group to the other side. At the partner, this group decides who may join external channels. At the host, it’s the group the host allows in.

Find the other tenant’s ID from its domain name:

Connect-MgGraph -Scopes 'CrossTenantInformation.ReadBasic.All'
$uri = "https://graph.microsoft.com/v1.0/tenantRelationships/findTenantInformationByDomainName(domainName='fabrikam.com')"
(Invoke-MgGraphRequest -Method GET -Uri $uri).tenantId

Step 2: Host (Contoso) allows inbound access

1. Microsoft Entra admin center → Entra ID → External Identities → Cross-tenant access settings.
2. Tab Organizational settings → Add organization → enter fabrikam.com or the tenant ID → Add. The organisation starts with your default settings, which block B2B direct connect. Leave your defaults as they are.
3. In the row for Fabrikam, select the link in the Inbound access column → tab B2B direct connect → Customize settings.
4. External users and groups: Allow access → Select external users and groups → add the object ID of Fabrikam’s group.
5. Applications: Allow access → Select applications → Add Microsoft applications → Office 365. That covers Teams and SharePoint.
6. Save.

Step 3: Host trusts the partner’s MFA

External participants can’t register MFA in your tenant. If your Conditional Access requires MFA for them, and it should, you must trust the MFA they did at home. Otherwise they are blocked.

1. Same row for Fabrikam → Inbound access → tab Trust settings → Customize settings.
2. Check Trust multifactor authentication from Microsoft Entra tenants.
3. Only if your policies require them and you agree with how Fabrikam manages devices: Trust compliant devices and Trust Microsoft Entra hybrid joined devices.
4. Optional: Automatically redeem invitations with the tenant. Participants then skip the consent prompt the first time. It only works if Fabrikam checks the same box for outbound.

Your Conditional Access applies to external participants when a policy targets All guest and external users (or B2B direct connect users) and the Office 365 SharePoint Online app. Supported grant controls are MFA, a compliant device and a hybrid joined device. The partner’s own policies are not used for access to your channel.

The same in PowerShell, including step 2. It updates the partner if it already exists:

# Run in the HOST tenant (Contoso)
Connect-MgGraph -Scopes 'Policy.ReadWrite.CrossTenantAccess'

$partnerTenant = '00000000-0000-0000-0000-000000000000'   # Fabrikam tenant ID
$partnerGroup  = '11111111-1111-1111-1111-111111111111'   # Fabrikam group object ID

$settings = @{
    b2bDirectConnectInbound = @{
        usersAndGroups = @{ accessType = 'allowed'; targets = @(@{ target = $partnerGroup; targetType = 'group' }) }
        applications   = @{ accessType = 'allowed'; targets = @(@{ target = 'Office365'; targetType = 'application' }) }
    }
    inboundTrust = @{
        isMfaAccepted                       = $true
        isCompliantDeviceAccepted           = $false
        isHybridAzureADJoinedDeviceAccepted = $false
    }
    automaticUserConsentSettings = @{ inboundAllowed = $true }
}

$exists = Get-MgPolicyCrossTenantAccessPolicyPartner -All | Where-Object TenantId -eq $partnerTenant
if ($exists) {
    Update-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerTenant -BodyParameter $settings
} else {
    New-MgPolicyCrossTenantAccessPolicyPartner -BodyParameter ($settings + @{ tenantId = $partnerTenant })
}

To allow every Fabrikam user instead of one group, use @{ target = 'AllUsers'; targetType = 'user' }. We don’t recommend it.

Step 4: Partner (Fabrikam) allows outbound access

1. Cross-tenant access settings → Organizational settings → Add organization → contoso.com.
2. Row for Contoso → Outbound access → tab B2B direct connect → Customize settings.
3. Users and groups: Allow access → Select users and groups → your own group SG-SharedChannels-Contoso.
4. External applications: Allow access → Select external applications → Add Microsoft applications → Office 365.
5. Optional, and only together with the host: Trust settings → Automatically redeem invitations for outbound.

# Run in the PARTNER tenant (Fabrikam)
Connect-MgGraph -Scopes 'Policy.ReadWrite.CrossTenantAccess'

$hostTenant = '22222222-2222-2222-2222-222222222222'   # Contoso tenant ID
$ownGroup   = '33333333-3333-3333-3333-333333333333'   # your own participants group

$settings = @{
    b2bDirectConnectOutbound = @{
        usersAndGroups = @{ accessType = 'allowed'; targets = @(@{ target = $ownGroup; targetType = 'group' }) }
        applications   = @{ accessType = 'allowed'; targets = @(@{ target = 'Office365'; targetType = 'application' }) }
    }
    automaticUserConsentSettings = @{ outboundAllowed = $true }
}

$exists = Get-MgPolicyCrossTenantAccessPolicyPartner -All | Where-Object TenantId -eq $hostTenant
if ($exists) {
    Update-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $hostTenant -BodyParameter $settings
} else {
    New-MgPolicyCrossTenantAccessPolicyPartner -BodyParameter ($settings + @{ tenantId = $hostTenant })
}

A policy that names a specific tenant is stored in your tenant and in that tenant. Both admins can see it.

Step 5: Teams policies (both tenants)

Teams admin center → Teams → Teams policies. Three settings matter:

Check what your Global policy allows first. To keep the external settings for your group only, turn them off in Global and give the group its own policy:

Connect-MicrosoftTeams
Get-CsTeamsChannelsPolicy -Identity Global |
    Select-Object AllowSharedChannelCreation, AllowChannelSharingToExternalUser, AllowUserToParticipateInExternalSharedChannel

# Only the participants group may share with and join other organisations
New-CsTeamsChannelsPolicy -Identity 'SharedChannels-External' -AllowSharedChannelCreation $true `
    -AllowChannelSharingToExternalUser $true -AllowUserToParticipateInExternalSharedChannel $true
New-CsGroupPolicyAssignment -GroupId '33333333-3333-3333-3333-333333333333' `
    -PolicyType TeamsChannelsPolicy -PolicyName 'SharedChannels-External' -Rank 1
Set-CsTeamsChannelsPolicy -Identity Global -AllowChannelSharingToExternalUser $false `
    -AllowUserToParticipateInExternalSharedChannel $false

Turning a setting off later doesn’t remove people who are already in a channel. And a team that was added to an external shared channel keeps giving its new members access.

Step 6: External access (both tenants)

Teams admin center → Users → External access. Make sure the other organisation’s domain is not blocked. Without it, participants don’t see each other’s presence and external participants can’t join meetings in the channel. Since February 2026 this sits in the new external collaboration screen (Open, Controlled or Custom). If you use an allow list, add the domain.

Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers, AllowedDomains, BlockedDomains

Step 7: Test and check

1. At Contoso, a team owner in the group creates a channel of type Shared, then Share channel → Share with people and enters a Fabrikam user. Use the UPN if it differs from the email address.
2. The Fabrikam user sees the channel in their own Teams under Contoso’s team, without switching tenants. Open the channel, post a message and open the Files tab.
3. In both tenants, open Sign-in logs in Entra and filter on Cross tenant access type = B2B direct connect. The host sees which Conditional Access policies were applied.

Compare both sides’ settings with this snippet (run in each tenant, with the other tenant’s ID):

Get-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerTenant |
    Select-Object TenantId,
        @{ n = 'Inbound users';  e = { $_.B2bDirectConnectInbound.UsersAndGroups.AccessType } },
        @{ n = 'Inbound apps';   e = { $_.B2bDirectConnectInbound.Applications.AccessType } },
        @{ n = 'Outbound users'; e = { $_.B2bDirectConnectOutbound.UsersAndGroups.AccessType } },
        @{ n = 'Outbound apps';  e = { $_.B2bDirectConnectOutbound.Applications.AccessType } },
        @{ n = 'MFA trusted';    e = { $_.InboundTrust.IsMfaAccepted } }

Common errors

Undo or end the collaboration

1. Remove the external participants and shared teams from the channel, or archive or delete the channel. A deleted shared channel can be restored within 30 days.
2. Check the channel’s SharePoint site for files shared directly with external people. Removing someone from the channel does not remove access given through SharePoint sharing.
3. Remove the organisation in cross-tenant access, or set B2B direct connect back to blocked. Access tokens are valid for an hour, so an open session can keep working for a short while.

Remove-MgPolicyCrossTenantAccessPolicyPartner -CrossTenantAccessPolicyConfigurationPartnerTenantId $partnerTenant

Removing the partner also removes any B2B collaboration settings you made for that organisation, not only B2B direct connect. Change only the B2B direct connect tab if you still use guest access with them.

Sources

• B2B direct connect overview (Microsoft Learn)
• Set up B2B direct connect (Microsoft Learn)
• Collaborate with external participants in a shared channel (Microsoft Learn)
• Shared channels in Microsoft Teams (Microsoft Learn)
• Set-CsTeamsChannelsPolicy (Microsoft Learn)