AADCrossTenantAccessPolicyConfigurationPartner¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
PartnerTenantId	Key	String	The tenant identifier for the partner Azure Active Directory (Azure AD) organization.
AppServiceConnectInbound	Write	MSFT_AADCrossTenantAccessPolicyAppServiceConnectSetting	Defines your partner-specific configuration for inbound app service connect settings that control which applications can connect across tenant boundaries with the partner organization.
B2BCollaborationInbound	Write	MSFT_AADCrossTenantAccessPolicyB2BSetting	Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B collaboration.
B2BCollaborationOutbound	Write	MSFT_AADCrossTenantAccessPolicyB2BSetting	Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B collaboration.
B2BDirectConnectInbound	Write	MSFT_AADCrossTenantAccessPolicyB2BSetting	Defines your partner-specific configuration for users from other organizations accessing your resources via Azure AD B2B direct connect.
B2BDirectConnectOutbound	Write	MSFT_AADCrossTenantAccessPolicyB2BSetting	Defines your partner-specific configuration for users in your organization going outbound to access resources in another organization via Azure AD B2B direct connect.
BlockServiceProviderOutboundAccess	Write	Boolean	Specifies whether users can use granular delegated admin privileges (GDAP) to sign-in and access resources in other organizations. Default value is false.
AutomaticUserConsentSettings	Write	MSFT_AADCrossTenantAccessPolicyAutomaticUserConsentSettings	Determines the partner-specific configuration for accepting trust claims from other tenant invitations.
IdentitySynchronization	Write	MSFT_AADCrossTenantIdentitySyncPolicyPartnerInbound	Defines the identity synchronization settings.
InboundTrust	Write	MSFT_AADCrossTenantAccessPolicyInboundTrust	Determines the partner-specific configuration for trusting other Conditional Access claims from external Azure AD organizations.
M365CollaborationInbound	Write	MSFT_AADCrossTenantAccessPolicyM365CollaborationInboundSetting	Defines your partner-specific configuration for inbound Microsoft 365 collaboration settings that determine which users from the partner organization can collaborate with your organization using Microsoft 365 apps.
M365CollaborationOutbound	Write	MSFT_AADCrossTenantAccessPolicyM365CollaborationOutboundSetting	Defines your partner-specific configuration for outbound Microsoft 365 collaboration settings that determine which users in your organization can collaborate with the partner organization using Microsoft 365 apps.
TenantRestrictions	Write	MSFT_AADCrossTenantAccessPolicyTenantRestrictions	Defines the partner-specific tenant restrictions configuration for users in your organization who access an external organization on your network or devices.
Ensure	Write	String	Specify if the policy should exist or not.	`Present`, `Absent`
Credential	Write	PSCredential	Credentials of the Admin
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Id of the Azure Active Directory tenant used for authentication.
ApplicationSecret	Write	PSCredential	Secret of the Azure Active Directory tenant used for authentication.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
CertificatePassword	Write	PSCredential	Username can be made up to anything but password will be used for CertificatePassword
CertificatePath	Write	String	Path to certificate used in service principal usually a PFX file.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	String[]	Access token used for authentication.

Embedded Instances¶

MSFT_AADCrossTenantAccessPolicyAppServiceConnectSetting¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
Applications	Write	MSFT_AADCrossTenantAccessPolicyTargetConfiguration	Defines the target applications that are allowed for inbound app service connect across tenant boundaries.

MSFT_AADCrossTenantAccessPolicyB2BSetting¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
Applications	Write	MSFT_AADCrossTenantAccessPolicyTargetConfiguration	The list of applications targeted with your cross-tenant access policy.
UsersAndGroups	Write	MSFT_AADCrossTenantAccessPolicyTargetConfiguration	The list of users and groups targeted with your cross-tenant access policy.

MSFT_AADCrossTenantAccessPolicyAutomaticUserConsentSettings¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
InboundAllowed	Write	Boolean	Specifies whether you want to automatically trust Inbound invitations.
OutboundAllowed	Write	Boolean	Specifies whether you want to automatically trust Outbound invitations.

MSFT_AADCrossTenantIdentitySyncPolicyPartnerInbound¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
GroupSyncInbound	Write	MSFT_AADCrossTenantGroupSyncInbound	Defines whether groups can be synchronized from a partner tenant. Key.
UserSyncInbound	Write	MSFT_AADCrossTenantUserSyncInbound	Specifies whether you want to automatically trust Outbound invitations.

MSFT_AADCrossTenantAccessPolicyInboundTrust¶

Parameters¶

Parameter	Attribute	DataType	Description
IsCompliantDeviceAccepted	Write	Boolean	Specifies whether compliant devices from external Azure AD organizations are trusted.
IsHybridAzureADJoinedDeviceAccepted	Write	Boolean	Specifies whether hybrid Azure AD joined devices from external Azure AD organizations are trusted.
IsMfaAccepted	Write	Boolean	Specifies whether MFA from external Azure AD organizations is trusted.

MSFT_AADCrossTenantAccessPolicyM365CollaborationInboundSetting¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
Users	Write	MSFT_AADCrossTenantAccessPolicyTargetConfiguration	Defines the target users from other organizations who are allowed inbound Microsoft 365 collaboration with your organization.

MSFT_AADCrossTenantAccessPolicyM365CollaborationOutboundSetting¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
UsersAndGroups	Write	MSFT_AADCrossTenantAccessPolicyTargetConfiguration	Defines the target users and groups in your organization who are allowed outbound Microsoft 365 collaboration with external organizations.

MSFT_AADCrossTenantAccessPolicyTenantRestrictions¶

Parameters¶

Parameter	Attribute	DataType	Description
Applications	Write	MSFT_AADCrossTenantAccessPolicyTargetConfiguration	The list of applications targeted with your cross-tenant access policy.
Devices	Write	MSFT_AADDevicesFilter	Defines the rule for filtering devices and whether devices satisfying the rule should be allowed or blocked. This property isn't supported on the server side yet.
UsersAndGroups	Write	MSFT_AADCrossTenantAccessPolicyTargetConfiguration	The list of users and groups targeted with your cross-tenant access policy.

MSFT_AADCrossTenantAccessPolicyTargetConfiguration¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
AccessType	Write	String	Defines whether access is allowed or blocked. The possible values are: allowed, blocked, unknownFutureValue.	`allowed`, `blocked`, `unknownFutureValue`
Targets	Write	MSFT_AADCrossTenantAccessPolicyTarget[]	Specifies whether to target users, groups, or applications with this rule.

MSFT_AADCrossTenantGroupSyncInbound¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
IsSyncAllowed	Write	Boolean	Defines whether group objects should be synchronized from the partner tenant. false stops any current group synchronization from the source tenant to the target tenant. This property has no impact on existing groups that were synchronized.

MSFT_AADCrossTenantUserSyncInbound¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
IsSyncAllowed	Write	Boolean	Defines whether user objects should be synchronized from the partner tenant. false causes any current user synchronization from the source tenant to the target tenant to stop. This property has no impact on existing users who have already been synchronized.

MSFT_AADDevicesFilter¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
Mode	Write	String	Determines whether devices that satisfy the rule should be allowed or blocked. The possible values are: allowed, blocked.	`allowed`, `blocked`
Rule	Write	String	Defines the rule to filter the devices. For example, 'device.deviceAttribute2 -eq 'PrivilegedAccessWorkstation'.

MSFT_AADCrossTenantAccessPolicyTarget¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
Target	Required	String	Defines the target for cross-tenant access policy settings and can have one of the following values: The unique identifier of the user, group, or application, AllUsers, AllApplications - Refers to any Microsoft cloud application, Office365 - Includes the applications mentioned as part of the Office 365 suite.
TargetType	Required	String	The type of resource that you want to target. The possible values are: user, group, application, unknownFutureValue.	`user`, `group`, `application`, `unknownFutureValue`

Description¶

This resource manages Azure AD Cross Tenant Access Policies Configuration Partner.

Permissions¶

Graph¶

To authenticate with the Graph API, this resource requires the following permissions:

Delegated permissions¶

Read
Policy.Read.All
Update
Policy.ReadWrite.CrossTenantAccess

Application permissions¶

Read
Policy.Read.All
Update
Policy.ReadWrite.CrossTenantAccess

Examples¶

Example 1¶

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        AADCrossTenantAccessPolicyConfigurationPartner "AADCrossTenantAccessPolicyConfigurationPartner-Example"
        {
            PartnerTenantId                    = "e7a80bcf-696e-40ca-8775-a7f85fbb3ebc"; # fabrikam.onmicrosoft.com
            AppServiceConnectInbound           = MSFT_AADCrossTenantAccessPolicyAppServiceConnectSetting{
                Applications = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'Office365'
                            TargetType = 'application'
                        }
                    )
                }
            };
            AutomaticUserConsentSettings       = MSFT_AADCrossTenantAccessPolicyAutomaticUserConsentSettings {
                InboundAllowed  = $True
                OutboundAllowed = $True
            };
            B2BCollaborationOutbound           = MSFT_AADCrossTenantAccessPolicyB2BSetting {
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = '68bafe64-f86b-4c4e-b33b-9d3eaa11544b' # Office 365
                            TargetType = 'user'
                        }
                    )
                }
            };
            B2BCollaborationInbound            = MSFT_AADCrossTenantAccessPolicyB2BSetting{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = '68bafe64-f86b-4c4e-b33b-9d3eaa11544b'
                            TargetType = 'user'
                        }
                    )
                }
            };
            B2BDirectConnectInbound            = MSFT_AADCrossTenantAccessPolicyB2BSetting{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            B2BDirectConnectOutbound           = MSFT_AADCrossTenantAccessPolicyB2BSetting{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            BlockServiceProviderOutboundAccess = $True;
            IdentitySynchronization            = MSFT_AADCrossTenantIdentitySyncPolicyPartnerInbound{
                GroupSyncInbound = MSFT_AADCrossTenantGroupSyncInbound{
                    IsSyncAllowed = $False
                }
                UserSyncInbound  = MSFT_AADCrossTenantUserSyncInbound{
                    IsSyncAllowed = $False
                }
            };
            InboundTrust                       = MSFT_AADCrossTenantAccessPolicyInboundTrust{
                IsCompliantDeviceAccepted           = $True
                IsHybridAzureADJoinedDeviceAccepted = $True
                IsMfaAccepted                       = $True
            };
            M365CollaborationInbound           = MSFT_AADCrossTenantAccessPolicyM365CollaborationInboundSetting{
                Users = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            M365CollaborationOutbound          = MSFT_AADCrossTenantAccessPolicyM365CollaborationOutboundSetting{
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            TenantRestrictions                 = MSFT_AADCrossTenantAccessPolicyTenantRestrictions{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            Ensure                             = "Present";
            ApplicationId                      = $ApplicationId
            TenantId                           = $TenantId
            CertificateThumbprint              = $CertificateThumbprint
        }
    }
}

Example 2¶

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        AADCrossTenantAccessPolicyConfigurationPartner "AADCrossTenantAccessPolicyConfigurationPartner-Example"
        {
            PartnerTenantId                    = "e7a80bcf-696e-40ca-8775-a7f85fbb3ebc"; # fabrikam.onmicrosoft.com
            AppServiceConnectInbound           = MSFT_AADCrossTenantAccessPolicyAppServiceConnectSetting{
                Applications = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'Office365'
                            TargetType = 'application'
                        }
                    )
                }
            };
            AutomaticUserConsentSettings       = MSFT_AADCrossTenantAccessPolicyAutomaticUserConsentSettings {
                InboundAllowed  = $False # Updated Property
                OutboundAllowed = $True
            };
            B2BCollaborationOutbound           = MSFT_AADCrossTenantAccessPolicyB2BSetting {
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = '68bafe64-f86b-4c4e-b33b-9d3eaa11544b' # Office 365
                            TargetType = 'user'
                        }
                    )
                }
            };
            B2BCollaborationInbound            = MSFT_AADCrossTenantAccessPolicyB2BSetting{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = '68bafe64-f86b-4c4e-b33b-9d3eaa11544b'
                            TargetType = 'user'
                        }
                    )
                }
            };
            B2BDirectConnectInbound            = MSFT_AADCrossTenantAccessPolicyB2BSetting{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            B2BDirectConnectOutbound           = MSFT_AADCrossTenantAccessPolicyB2BSetting{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            BlockServiceProviderOutboundAccess = $True;
            IdentitySynchronization            = MSFT_AADCrossTenantIdentitySyncPolicyPartnerInbound{
                GroupSyncInbound = MSFT_AADCrossTenantGroupSyncInbound{
                    IsSyncAllowed = $False
                }
                UserSyncInbound  = MSFT_AADCrossTenantUserSyncInbound{
                    IsSyncAllowed = $False
                }
            };
            InboundTrust                       = MSFT_AADCrossTenantAccessPolicyInboundTrust{
                IsCompliantDeviceAccepted           = $True
                IsHybridAzureADJoinedDeviceAccepted = $True
                IsMfaAccepted                       = $True
            };
            M365CollaborationInbound           = MSFT_AADCrossTenantAccessPolicyM365CollaborationInboundSetting{
                Users = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            M365CollaborationOutbound          = MSFT_AADCrossTenantAccessPolicyM365CollaborationOutboundSetting{
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'allowed'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            TenantRestrictions                 = MSFT_AADCrossTenantAccessPolicyTenantRestrictions{
                Applications   = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllApplications'
                            TargetType = 'application'
                        }
                    )
                }
                UsersAndGroups = MSFT_AADCrossTenantAccessPolicyTargetConfiguration{
                    AccessType = 'blocked'
                    Targets    = @(
                        MSFT_AADCrossTenantAccessPolicyTarget{
                            Target     = 'AllUsers'
                            TargetType = 'user'
                        }
                    )
                }
            };
            Ensure                             = "Present";
            ApplicationId                      = $ApplicationId
            TenantId                           = $TenantId
            CertificateThumbprint              = $CertificateThumbprint
        }
    }
}

Example 3¶

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        AADCrossTenantAccessPolicyConfigurationPartner "AADCrossTenantAccessPolicyConfigurationPartner-Example"
        {
            Ensure                = "Absent";
            PartnerTenantId       = "e7a80bcf-696e-40ca-8775-a7f85fbb3ebc";
            ApplicationId         = $ApplicationId
            TenantId              = $TenantId
            CertificateThumbprint = $CertificateThumbprint
        }
    }
}