Using Azure AD B2B Collaboration for extranet with multiple partners

[JakobRohde]

Hi

If we use AAD B2B Collaboration with many partners for an extranet solution in SharePoint Online, and if we don't want users from one partner to be able to access another partners site, we would have to create separate groups for each parter - or in some cases even for each site collection, right?

Thanks

Jakob

[#2]

I typically recommend creating separate site collections for collaboration with each partner. This provides a very clear and easy to understand boundary for the business users and site admins.

[#3]

It's not any different than if you have internal users in your company that you want to make sure don't have access to each others sites.

The other thing you may to look for is if Partner A shares a site or content to Partner B.

Hopefully unlikely, but possible to do.

[#4]

Why do you need to use Azure B2B? You could just share the content with them with the proper permissions and then an account gets created in your directory for the extranet users

[#5]

Azure B2B is a good solution if you don't want to get into the business of managing those external user accounts - i.e. the external company is responsible for forgotten passwords and keeping track of who they fired etc.

But if it is a user from a small company or standalone guy, then yes, it is probably easier to use the built-in Guest sharing features.

[#6]

Yea I know with Azure AD B2B you can create is an ubiquitous id in AzureAD. I think that's great in 2 scenarios: if the external users need access to apps other than SharePoint as well or if you have Azure App Proxy and some on premise apps that could add the complexities of that Auth. But in a straight SharePoint online scenario wouldn't be wiser just to use external sharing? Less admin effort simply allow sharing and only allow external access to the site or site collection they need to see. Make sure you require login for access and the auth is the same with less work. If they get fired and the account is revoked the same thing happens. Also does SHO see the B2B user as external? If not I feel like you are adding overhead for making sure the partner can't see anything not meant for them.

[#7]

I agree with everything you say - except unless you double as super-HR guy, there is no way for you to know when the person you shared content to was fired from the other company and they'll continue to have access to your SPO site(s) until someone figures out that person shouldn't be there anymore.
(Because the user is accessing your SPO site via their Microsoft account, not their work account).
Whether or not this is important to you may depend on the sensitivity of the data - if the guy you originally shared to quit your partner to work for a competitor then you may have some concerns.

[#8]

Completely forgot that they allowed Sharing to Microsoft accounts. You can limit to the domain so they can't log in with a random accounts but that is a huge hole. Thanks for pointing that out. Really wish Microsoft would allow you to limit that without killing sharing totally.

[#9]

Hey folks - 

Thanks for your interest in B2B. Check out the latest updates in Azure AD B2B below:

Blog: https://blogs.technet.microsoft.com/enterprisemobility/2017/02/01/azure-ad-b2b-new-updates-make-cros...

Documentation: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-b2b-what-is-azure-ad-b2b

Microsoft Tech Community forum: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-B2B/bd-p/AzureAD_B2b 

Add Tag...

[#10]

Thanks for your interest in B2B. Check out the latest updates in Azure AD B2B below:

Blog: https://blogs.technet.microsoft.com/enterprisemobility/2017/02/01/azure-ad-b2b-new-updates-make-cros...

Documentation: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-b2b-what-is-azure-ad-b2b

Microsoft Tech Community forum: https://techcommunity.microsoft.com/t5/Azure-Active-Directory-B2B/bd-p/AzureAD_B2b 

[#11]

Yes, we are working on the Allowlist functionality that will let you control the orgs/domains you want your org to collaborate with.