Question

Contoso allows partner organizations to access an internal SharePoint site using Microsoft Entra B2B collaboration. Security requires that all external guest users must complete multi-factor authentication before accessing the site, while internal employees who are already covered by an organization-wide MFA policy should not be prompted twice. You want the least administrative overhead and no impact on the partners' own tenant configuration. What should you recommend?

Accepted Answer

Create a Conditional Access policy scoped to Guest and external users that requires multi-factor authentication for the SharePoint cloud app.

Answer

Enable per-user MFA for each guest account as it is invited into the Contoso tenant.

Answer

Configure cross-tenant access settings to trust MFA claims from the partner tenants for all guest sign-ins.

Answer

Enable security defaults in the Contoso tenant to force MFA on all users including guests.