Real experience with Entra ID B2B for cross-org collaboration

ci_cd_enthusiast · 2026-08-08T09:25:58Z

Just finished a six-month project where we used Microsoft Entra ID B2B to collaborate with three external development partners. We needed to give them secure, auditable access to specific Azure DevOps projects and a handful of internal APIs, without creating local accounts or managing their credentials. Overall, it's been a solid win for our CI/CD pipelines and security posture. The magic is in the granular, conditional access. We could enforce MFA for all guests, restrict access to only the apps we specified, and tie it all to their own identity provider. No more sharing service account passwords in Slack! 😅 Here’s a snippet of the Azure AD Conditional Access policy we applied to our B2B users for accessing Azure DevOps. This ensured they could only connect from their corporate networks: ```json { "displayName": "Require corp network for external partners", "state": "enabled", "conditions": { "applications": { "includeApplications": ["Azure DevOps App ID"] }, "users": { "includeUsers": ["All guests and external users"] }, "locations": { "includeLocations": ["Trusted partner IP ranges"], "excludeLocations": ["All trusted locations"] } }, "grantControls": { "operator": "AND", "builtInControls": ["block"] } } ``` **Key takeaways from our rollout:** * **Onboarding friction was low.** The invitation redemption flow is smooth for users. * **Auditing is built-in.** Every access event is tied to their original identity, which our SecOps team loves. * **The main hiccup** was around app consent. Some partners had initial confusion when prompted for permissions, but a quick guide we drafted solved that. For those using it, how have you integrated B2B guests into your automated workflows? Any clever uses with service principals or managing access in Infrastructure as Code (like Terraform)? -pipelinepilot

Page 2 / 2 Prev

Microsoft Entra ID Reviews

Last Post by amy_w 43 minutes ago

17 Posts

16 Users

0 Reactions

1 Views

RSS

grafana_guy_night

(@grafana_guy_night)

Reputable Member

Joined: 5 months ago

Posts: 258

08/08/2026 10:31 pm

The policy you've got is exactly what we need to set up for our new partner. Seeing the JSON helps a lot.

One quick question - how do you handle when a partner's developer needs access from home? Did you have to make a separate "emergency" policy, or is there a smoother way to handle that exception?

ReplyQuote

amy_w

(@amyw)

Reputable Member

Joined: 3 weeks ago

Posts: 193

09/08/2026 12:10 am

We used a "named location" for approved partner VPN ranges, which includes their corporate IPs *and* their official teleworker gateway. That's the smoother path.

But we still have an emergency break-glass account as a last resort, because sometimes their own VPN is down. It's heavily monitored and triggers a review.

measure twice, ship once

ReplyQuote

Page 2 / 2 Prev