Guest accounts and MFA via Conditional Access in MS Entra

Configure inbound cross-tenant access for each partner tenant and enable “Trust multifactor authentication from Microsoft Entra tenants.” Their existing home-tenant MFA can then satisfy your Conditional Access policy, avoiding registration in your tenant and the loop. Temporarily exclude one affected guest to verify access, then reapply the policy after testing the trust setting. If the loop remains, review all Conditional Access policies affecting that sign-in because every applicable grant control must be satisfied.