In many of the Microsoft 365 environments I work with, collaborating across organizations is a top priority and, at the same time, a governance problem that keeps coming back. Teams shared channels were a real step forward, especially in combination with Microsoft Entra B2B direct connect. For the first time you can work with partners in Teams without filling your directory with guest accounts. Turning this on securely and properly across tenants, though, is more involved than it looks on paper.

B2B direct connect lets partners keep their own identity

Classic B2B guest access creates an account in your tenant. With B2B direct connect, users from a partner organization access shared Teams channels directly and keep their own identity. In practice that means fewer orphaned accounts, clearer compliance boundaries and a much cleaner audit trail. There is one catch. Both organizations have to set up mutual trust through cross-tenant access settings in the Microsoft Entra admin center, and if either side misses a step, collaboration simply fails. There's no fallback to guest accounts. Many organizations stick with classic guest invitations until a partner pushes for something better or the effort of managing guest sprawl forces a change. The B2B direct connect overview covers the basics, but in my experience the details decide more than any checklist does.

Configuration happens in cross-tenant access settings and Teams policies

You start in the Entra admin center under External Identities → Cross-tenant access settings. For each partner tenant you define organizational settings for inbound and outbound B2B direct connect. You can also choose to honor trust signals such as MFA and device compliance from the partner's tenant. That matters for Single Sign-On and keeps Conditional Access from becoming weaker than before. A global setting isn't enough, because every partner organization needs its own entry with explicit permissions. I went through the finer points in /blog/cross-tenant-access-settings-entra-id if you want more depth.

Next, open the Teams admin center and use Teams policies to control whether users can create or join shared channels with external partners. With the shared channels options you can pilot with a subset of users or enable it for the whole tenant. I'd strongly advise a slow rollout. Start with a test group, see how support and the helpdesk handle it, and expand only after that. You need both halves of this setup (Entra for trust, Teams for enablement), and if one is missing, end users get a broken experience.

Before going further, here's a simple diagram showing how B2B direct connect works for shared channels in Teams:

flowchart TD
  OwnTenant["Your tenant"] -->|"Channel shared"| PartnerTenant["Partner tenant"]
  PartnerUser["Partner user"] -->|"Access shared channel"| OwnTenant
  OwnUser["Your user"] -->|"Join partner channel"| PartnerTenant
  OwnTenant -->|"Cross-tenant access settings"| PartnerTenant

Figure: Shared channel collaboration in Teams through B2B direct connect

Partner users see far less than guests do

People often assume B2B direct connect users behave like guests. They don't. Partner users remain entirely in their home tenant and are limited to the shared channel and its content. They can't browse the rest of the team, see unrelated members or open other files. Some Teams apps and bots are unavailable or only partly available, and only the originating tenant can manage channel membership and settings. You can audit their activity, but external users aren't logged in quite as much detail as your own users. To avoid surprises, read the Teams shared channels documentation and test the important scenarios with real partners.

My tip: Before you enable shared channels, set up a short call between the Entra admins on both sides and align the cross-tenant access settings in advance. That alone prevents about 95% of the support issues you'd otherwise see later.

Classic access reviews don't cover B2B direct connect

This is one of the main governance gaps. B2B direct connect creates no guest accounts, so classic access reviews don't apply. Instead, you track channel membership through the Teams admin center and the access logs in Entra ID. If your organization needs more structure, access packages can handle requests, approvals and expiry for shared channel access (Access packages for guests). Be honest with stakeholders, though: reviewing access takes more manual work than it does for regular guests.

Auditing shared channel activity spans several tools

No single place shows you everything. The Teams admin center lists channel invitations and basic membership changes, but for deeper investigations you need the Entra ID sign-in logs, filtered for external users from partner organizations. If you use Microsoft Purview, its audit logs for Teams resource access add another layer. A quick practical step is to filter the sign-in logs by partner tenant domains so you can see who is accessing what. One more lesson I learned the hard way: put any new Conditional Access policy for B2B direct connect into report-only mode first. A misconfigured rule can lock out your partners, or yourselves, very easily.

Shared channels only work well when both sides make trust explicit

B2B direct connect for Teams shared channels moves collaboration a long way forward, but it depends entirely on mutual trust and coordination between the tenants. Security and productivity can finally work together here, without guest clutter and without the admin effort landing on one side only. Governance and auditing still need deliberate attention, and old patterns don't carry over as they are. I'd treat it as a joint process with your partners rather than a pure IT project. In the end, the policy that counts most is the trust you agree on together.