Most tenants have external access open to all domains, guest accounts from projects that ended months ago, and shared channels with no B2B Direct Connect configuration in Entra. This article covers the full external collaboration posture: a decision table for choosing the right mechanism by scenario, external access domain policies, guest access with Entra B2B cross-tenant trust (MFA trust, device compliance, automatic redemption), shared channels with B2B Direct Connect bilateral configuration, anonymous and unverified meeting users, Conditional Access policies for guest and external user types, lifecycle management with access reviews, a stale-guest identification script, common governance mistakes, an SMB quick-start priority list, and a 12-point audit checklist.
