User Types (Workforce Tenant)

B2B Collaboration Overview

• Invite external users to collaborate via email or self-service sign-up.
• Guests use own credentials (Entra ID, Microsoft account, social identity, or email OTP).
• No passwords to manage for guests; auth happens at their home organization.
• Invited user gets user object in your directory; user type = Guest by default.
• Invitation never expires; redemption via simple email link process.

Create & Invite Users

• Internal Member: Create new user in Entra ID admin center.
• Internal Guest: Create user, set UserType = Guest.
• B2B Guest/Member: Invite external user via "New user > Invite external user".
• Provide: Name, email, user type (Member/Guest), optional custom message.
• User receives invitation email with redemption link.

External Collaboration Settings

• Guest access level: Same as members | Limited | Most restrictive (own profile only).
• Invite permissions: Anyone | Members + admins | Admins only | No one.
• Self-service sign-up: Enable guest self-service for apps.
• Guest leave: Allow guests to remove themselves or require admin.
• Domain restrictions: Allow/deny specific domains for B2B invites.

Groups & Membership

• Security groups: Assign RBAC roles, manage permissions.
• Microsoft 365 groups: Collaboration (Teams, Outlook, SharePoint).
• Dynamic membership: Auto-add/remove based on user attributes (department, job title, etc.).
• Role-assignable groups: Assign Entra roles to group members (P1+ license required).
• Nested groups supported; max 2,048 group memberships per user.

Group-Based Licensing

• Assign one or more product licenses to a group.
• All members automatically get those licenses; removal on group exit.
• Changes typically effective within minutes.
• Supports conditional service plans (disable individual services in license).
• View license errors per group; managed in Microsoft 365 Admin Center.

Microsoft Entra Roles

Conditional Access for B2B

• Enforce MFA, device compliance, trusted locations for B2B users.
• Cross-tenant access: Trust MFA & device claims from partner Entra ID.
• Evaluate risk at home tenant (for external users) and resource tenant.
• User risk policy: Block risky sign-ins; password reset must occur at home org.

License Tiers & Prerequisites

Guest User Permissions

• Limited access (default): Blocked from user/group enumeration; see non-hidden groups.
• Same as members: Full directory visibility like internal members.
• Most restrictive: Access only own profile; no other user/group visibility.
• Can still be assigned admin roles or app access regardless of default permission level.

User Lifecycle & Offboarding

• Delete user: Entra ID > Users > Select user > Delete.
• Soft delete: Users recovered within 30 days by default.
• Permanent delete: After soft delete window, data purged.
• Guest removal: Delete guest object; does not affect home org account.
• Assign/remove licenses before deletion to avoid orphaned subscriptions.

Common Tasks