Week 5, Day 3 — Guest Access & Inter-Tenant Collaboration

Day 2 review & the external collaboration gap

• Ask: "Your Finance messaging policy blocks giphy and prevents users from deleting messages. If a guest joins a Finance team channel, do those restrictions apply to them?" — answer: guests have their own guest settings configured separately in the Teams Admin Centre, independent of internal messaging policies
• Ask: "Two Lakeview Logistics users chat with a supplier contact from contoso.com in Teams. What are the two completely different ways that supplier could be appearing in Teams — what is the difference between them technically?" — prime guest access vs external access
• Frame the day: this is the only lab in the course where students interact with each other's tenants. The inter-tenant pairing makes the guest/external distinction concrete in a way that personal email accounts cannot — both sides of the relationship are real M365 tenants with real admin controls on both ends.

Guest access vs external access — two very different models

The single most commonly confused distinction in Teams administration. Both let external people communicate with your team — but the architecture, capabilities, and governance are completely different.

• Guest settings — what guests can do — configured in Teams Admin Centre → Org-wide settings → Guest access. Key controls: allow calling (1:1), allow meeting, allow screen sharing, allow IP video, allow creating/updating channels. These are the capabilities all guests get across all teams. Per-team guest permissions (set in team settings) can be more restrictive but not more permissive.
• External access — federation settings — configured in Teams Admin Centre → External access. Options: allow all external domains (open federation), allow only specific domains (allow list), block specific domains (block list), or block all external access. Federation allows chat and calling but nothing else — no team membership, no file access.
• The CA policy interaction — when a guest signs into your tenant (via guest access), your Conditional Access policies evaluate the sign-in. If CA001 requires MFA, the guest may be challenged — unless their home tenant already performed MFA and cross-tenant trust settings honour that claim. This is B2B trust configuration — relevant when you see guests getting unexpected MFA prompts.
• Week 4 SharePoint external sharing connection — Teams guest access and SharePoint external sharing are separate controls that interact. Enabling guest access in Teams does NOT automatically enable external sharing in SharePoint. Both must be configured. When a guest is invited to a team, they get access to the team's SharePoint site — but only if SharePoint external sharing permits guests on that site.

Lab 5-C: Inter-tenant guest access and external federation

Paired with a classmate's tenant, students configure guest access settings, update the SharePoint allow list to permit their partner's domain, invite their partner as a guest to the Sales team, experience the guest sign-in from the other side, test guest limitations, configure external access federation, and compare the two collaboration models side by side.

• Step 1 — Configure Teams guest access settings (8 min)
  Navigate to admin.teams.microsoft.com → Org-wide settings → Guest access. Confirm guest access is enabled. Configure:
  · Allow calling: On · Allow meeting: On · Allow screen sharing: On
  · Allow IP video: On · Allow guests to create/update channels: Off
  · Allow guests to delete channels: Off
  Save. Record all settings.
• Step 2 — Update the SharePoint allow list for your partner's domain (5 min)
  Navigate to the SharePoint admin centre → Policies → Sharing → More external sharing settings → Limit external sharing by domain. Your allow list currently contains contoso.com (from Lab 4-C). Add your partner's subdomain (e.g. lakeviewlogisticsjd.nw7.nat-acc.ca). Save. This is required so the guest can access the team's SharePoint files.
• Step 3 — Invite your partner as a guest to the Sales team (10 min)
  Navigate to teams.microsoft.com. Open the Sales Department team → … → Add member. Enter your partner's admin account UPN (e.g. admin@lakeviewlogisticsjd.nw7.nat-acc.ca). Add as a Guest. Send the invitation.
  
  While waiting for your partner to accept, navigate to entra.microsoft.com → Users → All users → filter by Guest. Observe the guest account being created. Record its UPN format — note how it differs from an internal account UPN.
• Step 4 — Experience being a guest (your partner invites you) (10 min)
  Your partner has (or will) invite your admin account to their Sales team. Check your email inbox for the guest invitation. Accept it via the link in the email.
  
  Navigate to teams.microsoft.com and sign in with your admin account. You should see a tenant switcher in the top-right corner. Switch to your partner's tenant. Explore what you can see and do as a guest:
  · Can you see the Sales team? · Can you see other teams? · Can you access files? · Can you post in channels? · Can you create a channel? · Can you access team settings?
  
  Record everything you can and cannot do in your Lab Journal.
• Step 5 — Test CA policy interaction (8 min)
  While signed into your partner's tenant as a guest, navigate to entra.microsoft.com on your partner's tenant. Does your partner's CA001 policy (if enabled) apply to your guest sign-in? Note any MFA prompts you receive and whether they come from your home tenant or your partner's tenant. Record the behaviour in your Lab Journal.
• Step 6 — Configure external access (federation) and compare (10 min)
  Return to your own tenant. Navigate to Teams Admin Centre → Org-wide settings → External access. Review the current setting. If not already configured, set to Allow only specific external domains and add your partner's domain. Save.
  
  Without being a guest, open Teams and use the Search bar to find your partner's admin account by their full UPN. Try to start a 1:1 chat. Compare the experience — can you chat? Can you join their team? Can you access their files? Record the comparison.
  
  This demonstrates external access (federation) — you can chat without being a guest, but the capabilities are far more limited.
• Step 7 — Review guest account in Entra ID and clean up (9 min)
  Navigate to entra.microsoft.com → Users → All users → filter by Guest. Find your partner's guest account. Record all properties shown. Then remove your partner from the Sales team: Teams → Sales team → Members → find your partner → Remove. Verify the guest account still exists in Entra ID after removal from the team — guest account removal from a team does not delete the Entra ID account.

⭐ Bonus: Guest policy settings & monitoring

Reflection & preview

• Ask: "Your partner is a guest in your Sales team. They are also federated via external access. In one Teams session, can they use both — be a guest member AND chat via federation simultaneously?" — answer: yes, they coexist. As a guest they have team membership; via federation they can also reach anyone in your org by search.
• Ask: "You removed your partner from the Sales team. Their guest Entra ID account still exists. If you send them an email to their guest UPN (the #EXT# format), what happens?" — surface the guest account persistence issue and why governance of guest accounts matters
• Ask: "Your CA001 policy requires MFA for all users. Your partner signed into your tenant as a guest and did not get an MFA prompt — even though they had no MFA registered in your tenant. Why?" — surface B2B MFA trust: their home tenant already performed MFA and the claim was honoured
• Exit ticket: describe two specific scenarios at Lakeview Logistics — one where guest access is the right model and one where external access (federation) is the right model. Explain why each scenario requires a different approach.
• Preview Day 4: guest access governs who from outside can participate. Day 4 covers meetings — recording policies, lobby settings, live events, and the compliance considerations around meeting content.