question

TechSantosh-6750 avatar image
0 Votes"
TechSantosh-6750 asked amanpreetsingh-msft commented

Is it possible to create Azure AD trust with other Azure AD tenant for Azure B2B setup

Hi,
Is it possible to create Azure AD trust with other Azure AD tenant for Azure B2B setup?
We have an on-premise application that needs to accessed by internal users & external users (Guest account) in Azure tenant A. So is it possible to have only a trust between them as B2B collaboration.

What we want to archive is that Azure tenant B should

i)Access the application & they can onboard and additional users(contractors) as guest users in Azure tenant B.

ii) Azure tenant B users to mange the access (via groups that exist in Azure tenant A) for their guest users.

Note: We want to avoid federation

Or any other option please suggest

azure-ad-tenantazure-ad-b2b
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

amanpreetsingh-msft avatar image
1 Vote"
amanpreetsingh-msft answered amanpreetsingh-msft commented

Hi @TechSantosh-6750 · Welcome to Q&A platform and thanks for your query.

The above requirements can be achieved by using B2B User Flow.

i) Access the application & they can onboard and additional users(contractors) as guest users in Azure tenant B.

For this purpose, you need to navigate to:

Azure Active Directory > External Identities > User flows > +New user flow

While creating new user flow, Azure AD Sign up is selected by default as highlighted below. This will allow users in other Azure AD tenant to perform self service sign up and a guest user account will be added in your tenant.

38690-image.png

ii) Azure tenant B users to mange the access (via groups that exist in Azure tenant A) for their guest users.

If I understood it correctly, you want to add the guest users to specific groups in Tenant A for access management. You can leverage step 3 of user flow for this purpose where you can require user to specify a value for a custom attribute e.g. UserRole during self service signup. You can then create a dynamic group with query that adds users with UserRole=Contractor to ContractorGroup for instance.

To see the experience, you can try accessing my test application https://crafts.cloud365.in and on the sign in page click on create account link highlighted below:
38823-image.png

For step by step instructions on User flows, please refer to https://docs.microsoft.com/en-us/azure/active-directory/external-identities/self-service-sign-up-user-flow


Please "Accept the answer" if the information helped you. This will help us and others in the community as well.


image.png (10.2 KiB)
image.png (27.7 KiB)
· 3
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@TechSantosh-6750 · Just following up to see if you had a chance to test it out. Feel free to tag me in your reply if you need any help regarding this issue.

0 Votes 0 ·

Hi,
Thanks for the answer but my primary question was "Is it possible to create Azure AD trust with other Azure AD tenant for Azure B2B setup?". As per my knowledge trust can not be established. Could not find any concrete answer to it. Pls confirm if true.



0 Votes 0 ·

@TechSantosh-6750 · Right, there is no concept of trust in Azure AD.

0 Votes 0 ·