Question

Contoso and Fabrikam are partner organizations, both using Microsoft Entra ID. Fabrikam users are invited as B2B guests into Contoso's tenant to access a sensitive SharePoint site that requires multifactor authentication (MFA). Fabrikam already enforces MFA and compliant-device requirements on its own users. Contoso wants to avoid forcing Fabrikam guests to re-register and complete MFA a second time in Contoso's tenant, while still requiring MFA. What should the Contoso administrator configure?

Accepted Answer

In Cross-tenant access settings, edit the inbound trust settings for Fabrikam's organization and enable 'Trust multifactor authentication from Microsoft Entra tenants'.

Answer

Create a Conditional Access policy in Contoso that excludes all guest and external users from the MFA requirement.

Answer

In Fabrikam's tenant, configure outbound settings to disable MFA for users accessing Contoso.

Answer

Enable password hash synchronization between the Contoso and Fabrikam tenants so credentials are shared.