cross_tenant_access_policy_partners

Creates, updates, deletes, gets or lists a cross_tenant_access_policy_partners resource.

Overview

Name	cross_tenant_access_policy_partners
Type	Resource
Id	entra_id.policies.cross_tenant_access_policy_partners

Fields

The following fields are returned by SELECT queries:

get

Retrieved navigation property

Name	Datatype	Description
appServiceConnectInbound	object	Defines your partner-specific configuration for inbound app service connect settings that control which applications can connect across tenant boundaries with the partner organization. (title: crossTenantAccessPolicyAppServiceConnectSetting)
automaticUserConsentSettings	object	Determines the partner-specific configuration for automatic user consent settings. Unless specifically configured, the inboundAllowed and outboundAllowed properties are null and inherit from the default settings, which is always false. (title: inboundOutboundPolicyConfiguration)
b2bCollaborationInbound	object	Defines your partner-specific configuration for users from other organizations accessing your resources via Microsoft Entra B2B collaboration. (title: crossTenantAccessPolicyB2BSetting)
b2bCollaborationOutbound	object	Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B collaboration. (title: crossTenantAccessPolicyB2BSetting)
b2bDirectConnectInbound	object	Defines your partner-specific configuration for users from other organizations accessing your resources via Azure B2B direct connect. (title: crossTenantAccessPolicyB2BSetting)
b2bDirectConnectOutbound	object	Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B direct connect. (title: crossTenantAccessPolicyB2BSetting)
identitySynchronization	object	Defines the cross-tenant policy for the synchronization of users from a partner tenant. Use this user synchronization policy to streamline collaboration between users in a multitenant organization by automating the creation, update, and deletion of users from one tenant to another. (title: crossTenantIdentitySyncPolicyPartner)
inboundTrust	object	Determines the partner-specific configuration for trusting other Conditional Access claims from external Microsoft Entra organizations. (title: crossTenantAccessPolicyInboundTrust)
isInMultiTenantOrganization	boolean	Identifies whether a tenant is a member of a multitenant organization.
isServiceProvider	boolean	Identifies whether the partner-specific configuration is a Cloud Service Provider for your organization.
m365CollaborationInbound	object	Defines your partner-specific configuration for inbound Microsoft 365 collaboration settings that determine which users from the partner organization can collaborate with your organization using Microsoft 365 apps. (title: crossTenantAccessPolicyM365CollaborationInboundSetting)
m365CollaborationOutbound	object	Defines your partner-specific configuration for outbound Microsoft 365 collaboration settings that determine which users in your organization can collaborate with the partner organization using Microsoft 365 apps. (title: crossTenantAccessPolicyM365CollaborationOutboundSetting)
tenantId	string	The tenant identifier for the partner Microsoft Entra organization. Read-only. Key.
tenantRestrictions	object	Defines the partner-specific tenant restrictions configuration for users in your organization who access a partner organization using partner supplied identities on your network or devices. (x-ms-discriminator-value: #microsoft.graph.crossTenantAccessPolicyTenantRestrictions, title: crossTenantAccessPolicyB2BSetting)

list

Retrieved collection

Name	Datatype	Description
appServiceConnectInbound	object	Defines your partner-specific configuration for inbound app service connect settings that control which applications can connect across tenant boundaries with the partner organization. (title: crossTenantAccessPolicyAppServiceConnectSetting)
automaticUserConsentSettings	object	Determines the partner-specific configuration for automatic user consent settings. Unless specifically configured, the inboundAllowed and outboundAllowed properties are null and inherit from the default settings, which is always false. (title: inboundOutboundPolicyConfiguration)
b2bCollaborationInbound	object	Defines your partner-specific configuration for users from other organizations accessing your resources via Microsoft Entra B2B collaboration. (title: crossTenantAccessPolicyB2BSetting)
b2bCollaborationOutbound	object	Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B collaboration. (title: crossTenantAccessPolicyB2BSetting)
b2bDirectConnectInbound	object	Defines your partner-specific configuration for users from other organizations accessing your resources via Azure B2B direct connect. (title: crossTenantAccessPolicyB2BSetting)
b2bDirectConnectOutbound	object	Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B direct connect. (title: crossTenantAccessPolicyB2BSetting)
identitySynchronization	object	Defines the cross-tenant policy for the synchronization of users from a partner tenant. Use this user synchronization policy to streamline collaboration between users in a multitenant organization by automating the creation, update, and deletion of users from one tenant to another. (title: crossTenantIdentitySyncPolicyPartner)
inboundTrust	object	Determines the partner-specific configuration for trusting other Conditional Access claims from external Microsoft Entra organizations. (title: crossTenantAccessPolicyInboundTrust)
isInMultiTenantOrganization	boolean	Identifies whether a tenant is a member of a multitenant organization.
isServiceProvider	boolean	Identifies whether the partner-specific configuration is a Cloud Service Provider for your organization.
m365CollaborationInbound	object	Defines your partner-specific configuration for inbound Microsoft 365 collaboration settings that determine which users from the partner organization can collaborate with your organization using Microsoft 365 apps. (title: crossTenantAccessPolicyM365CollaborationInboundSetting)
m365CollaborationOutbound	object	Defines your partner-specific configuration for outbound Microsoft 365 collaboration settings that determine which users in your organization can collaborate with the partner organization using Microsoft 365 apps. (title: crossTenantAccessPolicyM365CollaborationOutboundSetting)
tenantId	string	The tenant identifier for the partner Microsoft Entra organization. Read-only. Key.
tenantRestrictions	object	Defines the partner-specific tenant restrictions configuration for users in your organization who access a partner organization using partner supplied identities on your network or devices. (x-ms-discriminator-value: #microsoft.graph.crossTenantAccessPolicyTenantRestrictions, title: crossTenantAccessPolicyB2BSetting)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	cross_tenant_access_policy_configuration_partner_tenant_id		Read the properties and relationships of a partner-specific configuration.
list	select			Get a list of all partner configurations within a cross-tenant access policy. You can also use the $expand parameter to list the user synchronization policy for all partner configurations.
insert	insert			Create a new partner configuration in a cross-tenant access policy.
update	update	cross_tenant_access_policy_configuration_partner_tenant_id		Update the properties of a partner-specific configuration.
delete	delete	cross_tenant_access_policy_configuration_partner_tenant_id	If-Match	Delete a partner-specific configuration in a cross-tenant access policy. If a configuration includes a user synchronization policy, you must first delete the user synchronization policy before you can delete the partner-specific configuration.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
cross_tenant_access_policy_configuration_partner_tenant_id	string	The unique identifier of crossTenantAccessPolicyConfigurationPartner
If-Match	string	ETag

SELECT examples

get

Read the properties and relationships of a partner-specific configuration.

SELECT
appServiceConnectInbound,
automaticUserConsentSettings,
b2bCollaborationInbound,
b2bCollaborationOutbound,
b2bDirectConnectInbound,
b2bDirectConnectOutbound,
identitySynchronization,
inboundTrust,
isInMultiTenantOrganization,
isServiceProvider,
m365CollaborationInbound,
m365CollaborationOutbound,
tenantId,
tenantRestrictions
FROM entra_id.policies.cross_tenant_access_policy_partners
WHERE cross_tenant_access_policy_configuration_partner_tenant_id = '{{ cross_tenant_access_policy_configuration_partner_tenant_id }}' -- required
;

list

Get a list of all partner configurations within a cross-tenant access policy. You can also use the $expand parameter to list the user synchronization policy for all partner configurations.

SELECT
appServiceConnectInbound,
automaticUserConsentSettings,
b2bCollaborationInbound,
b2bCollaborationOutbound,
b2bDirectConnectInbound,
b2bDirectConnectOutbound,
identitySynchronization,
inboundTrust,
isInMultiTenantOrganization,
isServiceProvider,
m365CollaborationInbound,
m365CollaborationOutbound,
tenantId,
tenantRestrictions
FROM entra_id.policies.cross_tenant_access_policy_partners
;

INSERT examples

insert

Create a new partner configuration in a cross-tenant access policy.

INSERT INTO entra_id.policies.cross_tenant_access_policy_partners (
appServiceConnectInbound,
automaticUserConsentSettings,
b2bCollaborationInbound,
b2bCollaborationOutbound,
b2bDirectConnectInbound,
b2bDirectConnectOutbound,
inboundTrust,
isInMultiTenantOrganization,
isServiceProvider,
m365CollaborationInbound,
m365CollaborationOutbound,
tenantId,
tenantRestrictions,
identitySynchronization
)
SELECT 
'{{ appServiceConnectInbound }}',
'{{ automaticUserConsentSettings }}',
'{{ b2bCollaborationInbound }}',
'{{ b2bCollaborationOutbound }}',
'{{ b2bDirectConnectInbound }}',
'{{ b2bDirectConnectOutbound }}',
'{{ inboundTrust }}',
{{ isInMultiTenantOrganization }},
{{ isServiceProvider }},
'{{ m365CollaborationInbound }}',
'{{ m365CollaborationOutbound }}',
'{{ tenantId }}',
'{{ tenantRestrictions }}',
'{{ identitySynchronization }}'
RETURNING
appServiceConnectInbound,
automaticUserConsentSettings,
b2bCollaborationInbound,
b2bCollaborationOutbound,
b2bDirectConnectInbound,
b2bDirectConnectOutbound,
identitySynchronization,
inboundTrust,
isInMultiTenantOrganization,
isServiceProvider,
m365CollaborationInbound,
m365CollaborationOutbound,
tenantId,
tenantRestrictions
;

Manifest

# Description fields are for documentation purposes
- name: cross_tenant_access_policy_partners
props:
  - name: appServiceConnectInbound
    description: |
      Defines your partner-specific configuration for inbound app service connect settings that control which applications can connect across tenant boundaries with the partner organization.
    value:
      applications:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
  - name: automaticUserConsentSettings
    description: |
      Determines the partner-specific configuration for automatic user consent settings. Unless specifically configured, the inboundAllowed and outboundAllowed properties are null and inherit from the default settings, which is always false.
    value:
      inboundAllowed: {{ inboundAllowed }}
      outboundAllowed: {{ outboundAllowed }}
  - name: b2bCollaborationInbound
    description: |
      Defines your partner-specific configuration for users from other organizations accessing your resources via Microsoft Entra B2B collaboration.
    value:
      applications:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
      usersAndGroups:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
  - name: b2bCollaborationOutbound
    description: |
      Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B collaboration.
    value:
      applications:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
      usersAndGroups:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
  - name: b2bDirectConnectInbound
    description: |
      Defines your partner-specific configuration for users from other organizations accessing your resources via Azure B2B direct connect.
    value:
      applications:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
      usersAndGroups:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
  - name: b2bDirectConnectOutbound
    description: |
      Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Microsoft Entra B2B direct connect.
    value:
      applications:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
      usersAndGroups:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
  - name: inboundTrust
    description: |
      Determines the partner-specific configuration for trusting other Conditional Access claims from external Microsoft Entra organizations.
    value:
      isCompliantDeviceAccepted: {{ isCompliantDeviceAccepted }}
      isHybridAzureADJoinedDeviceAccepted: {{ isHybridAzureADJoinedDeviceAccepted }}
      isMfaAccepted: {{ isMfaAccepted }}
  - name: isInMultiTenantOrganization
    value: {{ isInMultiTenantOrganization }}
    description: |
      Identifies whether a tenant is a member of a multitenant organization.
  - name: isServiceProvider
    value: {{ isServiceProvider }}
    description: |
      Identifies whether the partner-specific configuration is a Cloud Service Provider for your organization.
  - name: m365CollaborationInbound
    description: |
      Defines your partner-specific configuration for inbound Microsoft 365 collaboration settings that determine which users from the partner organization can collaborate with your organization using Microsoft 365 apps.
    value:
      users:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
  - name: m365CollaborationOutbound
    description: |
      Defines your partner-specific configuration for outbound Microsoft 365 collaboration settings that determine which users in your organization can collaborate with the partner organization using Microsoft 365 apps.
    value:
      usersAndGroups:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
  - name: tenantId
    value: "{{ tenantId }}"
    description: |
      The tenant identifier for the partner Microsoft Entra organization. Read-only. Key.
  - name: tenantRestrictions
    description: |
      Defines the partner-specific tenant restrictions configuration for users in your organization who access a partner organization using partner supplied identities on your network or devices.
    value:
      applications:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
      usersAndGroups:
        accessType: "{{ accessType }}"
        targets:
          - target: "{{ target }}"
            targetType: "{{ targetType }}"
      devices: "{{ devices }}"
  - name: identitySynchronization
    description: |
      Defines the cross-tenant policy for the synchronization of users from a partner tenant. Use this user synchronization policy to streamline collaboration between users in a multitenant organization by automating the creation, update, and deletion of users from one tenant to another.
    value:
      displayName: "{{ displayName }}"
      tenantId: "{{ tenantId }}"
      userSyncInbound:
        isSyncAllowed: {{ isSyncAllowed }}

UPDATE examples

update

Update the properties of a partner-specific configuration.

UPDATE entra_id.policies.cross_tenant_access_policy_partners
SET 
appServiceConnectInbound = '{{ appServiceConnectInbound }}',
automaticUserConsentSettings = '{{ automaticUserConsentSettings }}',
b2bCollaborationInbound = '{{ b2bCollaborationInbound }}',
b2bCollaborationOutbound = '{{ b2bCollaborationOutbound }}',
b2bDirectConnectInbound = '{{ b2bDirectConnectInbound }}',
b2bDirectConnectOutbound = '{{ b2bDirectConnectOutbound }}',
inboundTrust = '{{ inboundTrust }}',
isInMultiTenantOrganization = {{ isInMultiTenantOrganization }},
isServiceProvider = {{ isServiceProvider }},
m365CollaborationInbound = '{{ m365CollaborationInbound }}',
m365CollaborationOutbound = '{{ m365CollaborationOutbound }}',
tenantId = '{{ tenantId }}',
tenantRestrictions = '{{ tenantRestrictions }}',
identitySynchronization = '{{ identitySynchronization }}',
WHERE 
cross_tenant_access_policy_configuration_partner_tenant_id = '{{ cross_tenant_access_policy_configuration_partner_tenant_id }}' --required
RETURNING
appServiceConnectInbound,
automaticUserConsentSettings,
b2bCollaborationInbound,
b2bCollaborationOutbound,
b2bDirectConnectInbound,
b2bDirectConnectOutbound,
identitySynchronization,
inboundTrust,
isInMultiTenantOrganization,
isServiceProvider,
m365CollaborationInbound,
m365CollaborationOutbound,
tenantId,
tenantRestrictions;

DELETE examples

delete

Delete a partner-specific configuration in a cross-tenant access policy. If a configuration includes a user synchronization policy, you must first delete the user synchronization policy before you can delete the partner-specific configuration.

DELETE FROM entra_id.policies.cross_tenant_access_policy_partners
WHERE cross_tenant_access_policy_configuration_partner_tenant_id = '{{ cross_tenant_access_policy_configuration_partner_tenant_id }}' --required
AND If-Match = '{{ If-Match }}'
;