You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -242,6 +242,8 @@ Microsoft Authenticator can be used as a passwordless sign-in method and a secon
242
242
243
243
We recommend having your users register for combined security information, which is a single place to register their authentication methods and devices for both MFA and SSPR.
244
244
245
+
Authentication data can be migrated from MFA Server to Azure AD. This process doesn't require any end-user interaction during or after the migration, but it can result in stale data being migrated.
246
+
245
247
Microsoft provides communication templates that you can provide to your users to guide them through the combined registration process.
246
248
These include templates for email, posters, table tents, and various other assets. Users register their information at `https://aka.ms/mysecurityinfo`, which takes them to the combined security registration screen.
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/allow-deny-list.md
+29-23Lines changed: 29 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,89 +1,93 @@
1
1
---
2
2
3
3
title: Allow or block invites to specific organizations - Azure AD
4
-
description: Shows how an administrator can use the Azure portal or PowerShell to set an access or deny list to allow or block B2B users from certain domains.
4
+
description: Shows how an administrator can use the Azure portal or PowerShell to set an access or blocklist to allow or block B2B users from certain domains.
5
5
6
6
services: active-directory
7
7
ms.service: active-directory
8
8
ms.subservice: B2B
9
9
ms.topic: how-to
10
-
ms.date: 02/03/2021
10
+
ms.date: 08/31/2022
11
11
12
12
ms.author: mimart
13
13
author: msmimart
14
14
manager: celestedg
15
-
ms.reviewer: sasubram
16
15
ms.custom: "it-pro, seo-update-azuread-jan"
17
16
ms.collection: M365-identity-device-management
18
17
---
19
18
20
19
# Allow or block invitations to B2B users from specific organizations
21
20
22
-
You can use an allow list or a deny list to allow or block invitations to B2B users from specific organizations. For example, if you want to block personal email address domains, you can set up a deny list that contains domains like Gmail.com and Outlook.com. Or, if your business has a partnership with other businesses like Contoso.com, Fabrikam.com, and Litware.com, and you want to restrict invitations to only these organizations, you can add Contoso.com, Fabrikam.com, and Litware.com to your allow list.
21
+
You can use an allowlist or a blocklist to allow or block invitations to B2B collaboration users from specific organizations. For example, if you want to block personal email address domains, you can set up a blocklist that contains domains like Gmail.com and Outlook.com. Or, if your business has a partnership with other businesses like Contoso.com, Fabrikam.com, and Litware.com, and you want to restrict invitations to only these organizations, you can add Contoso.com, Fabrikam.com, and Litware.com to your allowlist.
22
+
23
+
This article discusses two ways to configure an allow or blocklist for B2B collaboration:
24
+
25
+
- In the portal by configuring collaboration restrictions in your organization's [External collaboration settings](external-collaboration-settings-configure.md)
26
+
- Through PowerShell
23
27
24
28
## Important considerations
25
29
26
-
- You can create either an allow list or a deny list. You can't set up both types of lists. By default, whatever domains are not in the allow list are on the deny list, and vice versa.
30
+
- You can create either an allowlist or a blocklist. You can't set up both types of lists. By default, whatever domains aren't in the allowlist are on the blocklist, and vice versa.
27
31
- You can create only one policy per organization. You can update the policy to include more domains, or you can delete the policy to create a new one.
28
-
- The number of domains you can add to an allow list or deny list is limited only by the size of the policy. This limit applies to the number of characters, so you can have a greater number of shorter domains or fewer longer domains. The maximum size of the entire policy is 25 KB (25,000 characters), which includes the allow list or deny list and any other parameters configured for other features.
29
-
- This list works independently from OneDrive for Business and SharePoint Online allow/block lists. If you want to restrict individual file sharing in SharePoint Online, you need to set up an allow or deny list for OneDrive for Business and SharePoint Online. For more information, see [Restricted domains sharing in SharePoint Online and OneDrive for Business](https://support.office.com/article/restricted-domains-sharing-in-sharepoint-online-and-onedrive-for-business-5d7589cd-0997-4a00-a2ba-2320ec49c4e9).
30
-
- The list does not apply to external users who have already redeemed the invitation. The list will be enforced after the list is set up. If a user invitation is in a pending state, and you set a policy that blocks their domain, the user's attempt to redeem the invitation will fail.
32
+
- The number of domains you can add to an allowlist or blocklist is limited only by the size of the policy. This limit applies to the number of characters, so you can have a greater number of shorter domains or fewer longer domains. The maximum size of the entire policy is 25 KB (25,000 characters), which includes the allowlist or blocklist and any other parameters configured for other features.
33
+
- This list works independently from OneDrive for Business and SharePoint Online allow/block lists. If you want to restrict individual file sharing in SharePoint Online, you need to set up an allow or blocklist for OneDrive for Business and SharePoint Online. For more information, see [Restricted domains sharing in SharePoint Online and OneDrive for Business](https://support.office.com/article/restricted-domains-sharing-in-sharepoint-online-and-onedrive-for-business-5d7589cd-0997-4a00-a2ba-2320ec49c4e9).
34
+
- The list doesn't apply to external users who have already redeemed the invitation. The list will be enforced after the list is set up. If a user invitation is in a pending state, and you set a policy that blocks their domain, the user's attempt to redeem the invitation will fail.
31
35
32
-
## Set the allow or deny list policy in the portal
36
+
## Set the allow or blocklist policy in the portal
33
37
34
38
By default, the **Allow invitations to be sent to any domain (most inclusive)** setting is enabled. In this case, you can invite B2B users from any organization.
35
39
36
-
### Add a deny list
40
+
### Add a blocklist
37
41
38
42
This is the most typical scenario, where your organization wants to work with almost any organization, but wants to prevent users from specific domains to be invited as B2B users.
39
43
40
-
To add a deny list:
44
+
To add a blocklist:
41
45
42
46
1. Sign in to the [Azure portal](https://portal.azure.com).
43
47
2. Select **Azure Active Directory** > **Users** > **User settings**.
44
48
3. Under **External users**, select **Manage external collaboration settings**.
45
49
4. Under **Collaboration restrictions**, select **Deny invitations to the specified domains**.
46
50
5. Under **TARGET DOMAINS**, enter the name of one of the domains that you want to block. For multiple domains, enter each domain on a new line. For example:
47
51
48
-
52
+
49
53
50
54
6. When you're done, select **Save**.
51
55
52
56
After you set the policy, if you try to invite a user from a blocked domain, you receive a message saying that the domain of the user is currently blocked by your invitation policy.
53
57
54
-
### Add an allow list
58
+
### Add an allowlist
55
59
56
-
This is a more restrictive configuration, where you can set specific domains in the allow list and restrict invitations to any other organizations or domains that aren't mentioned.
60
+
This is a more restrictive configuration, where you can set specific domains in the allowlist and restrict invitations to any other organizations or domains that aren't mentioned.
57
61
58
-
If you want to use an allow list, make sure that you spend time to fully evaluate what your business needs are. If you make this policy too restrictive, your users may choose to send documents over email, or find other non-IT sanctioned ways of collaborating.
62
+
If you want to use an allowlist, make sure that you spend time to fully evaluate what your business needs are. If you make this policy too restrictive, your users may choose to send documents over email, or find other non-IT sanctioned ways of collaborating.
59
63
60
64
61
-
To add an allow list:
65
+
To add an allowlist:
62
66
63
67
1. Sign in to the [Azure portal](https://portal.azure.com).
64
68
2. Select **Azure Active Directory** > **Users** > **User settings**.
65
69
3. Under **External users**, select **Manage external collaboration settings**.
66
70
4. Under **Collaboration restrictions**, select **Allow invitations only to the specified domains (most restrictive)**.
67
71
5. Under **TARGET DOMAINS**, enter the name of one of the domains that you want to allow. For multiple domains, enter each domain on a new line. For example:
68
72
69
-
73
+
70
74
71
75
6. When you're done, select **Save**.
72
76
73
-
After you set the policy, if you try to invite a user from a domain that's not on the allow list, you receive a message saying that the domain of the user is currently blocked by your invitation policy.
77
+
After you set the policy, if you try to invite a user from a domain that's not on the allowlist, you receive a message saying that the domain of the user is currently blocked by your invitation policy.
74
78
75
-
### Switch from allow list to deny list and vice versa
79
+
### Switch from allowlist to blocklist and vice versa
76
80
77
81
If you switch from one policy to the other, this discards the existing policy configuration. Make sure to back up details of your configuration before you perform the switch.
78
82
79
-
## Set the allow or deny list policy using PowerShell
83
+
## Set the allow or blocklist policy using PowerShell
80
84
81
85
### Prerequisite
82
86
83
87
> [!Note]
84
88
> The AzureADPreview Module is not a fully supported module as it is in preview.
85
89
86
-
To set the allow or deny list by using PowerShell, you must install the preview version of the Azure Active Directory Module for Windows PowerShell. Specifically, install the AzureADPreview module version 2.0.0.98 or later.
90
+
To set the allow or blocklist by using PowerShell, you must install the preview version of the Azure Active Directory Module for Windows PowerShell. Specifically, install the AzureADPreview module version 2.0.0.98 or later.
87
91
88
92
To check the version of the module (and see if it's installed):
89
93
@@ -124,7 +128,7 @@ If the module is not installed, or you don't have a required version, do one of
124
128
125
129
### Use the AzureADPolicy cmdlets to configure the policy
126
130
127
-
To create an allow or deny list, use the [New-AzureADPolicy](/powershell/module/azuread/new-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. The following example shows how to set a deny list that blocks the "live.com" domain.
131
+
To create an allow or blocklist, use the [New-AzureADPolicy](/powershell/module/azuread/new-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. The following example shows how to set a blocklist that blocks the "live.com" domain.
To set the allow or deny list policy, use the [Set-AzureADPolicy](/powershell/module/azuread/set-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. For example:
145
+
To set the allow or blocklist policy, use the [Set-AzureADPolicy](/powershell/module/azuread/set-azureadpolicy?view=azureadps-2.0-preview&preserve-view=true) cmdlet. For example:
- For an overview of Azure AD B2B, see [What is Azure AD B2B collaboration?](what-is-b2b.md)
166
+
- To learn more about managing B2B collaboration in your organization, see [External collaboration settings](external-collaboration-settings-configure.md).
167
+
162
168
- For information about Conditional Access and B2B collaboration, see [Conditional Access for B2B collaboration users](authentication-conditional-access.md).
This article contains recommendations and best practices for business-to-business (B2B) collaboration in Azure Active Directory (Azure AD).
19
19
20
20
> [!IMPORTANT]
21
-
> The email one-time passcode feature is now turned on by default for all new tenants and for any existing tenants where you haven't explicitly turned it off. Learn more about [configuring email one-time passcode](one-time-passcode.md) and [plans for other fallback authentication methods](one-time-passcode.md#disable-email-one-time-passcode), such as unmanaged ("viral") accounts and Microsoft accounts.
21
+
> The [email one-time passcode feature](one-time-passcode.md) is now turned on by default for all new tenants and for any existing tenants where you haven't explicitly turned it off. When this feature is turned off, the fallback authentication method is to prompt invitees to create a Microsoft account.
Copy file name to clipboardExpand all lines: articles/active-directory/external-identities/faq.yml
+3-3Lines changed: 3 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ metadata:
7
7
ms.service: active-directory
8
8
ms.subservice: B2B
9
9
ms.topic: faq
10
-
ms.date: 08/10/2022
10
+
ms.date: 08/30/2022
11
11
ms.author: mimart
12
12
author: msmimart
13
13
manager: celestedg
@@ -18,8 +18,8 @@ summary: |
18
18
These frequently asked questions (FAQs) about Azure Active Directory (Azure AD) business-to-business (B2B) collaboration are periodically updated to include new topics.
19
19
20
20
> [!IMPORTANT]
21
-
> - **Starting January 4, 2021**, Google is [deprecating WebView sign-in support](https://developers.googleblog.com/2020/08/guidance-for-our-effort-to-block-less-secure-browser-and-apps.html). If you’re using Google federation or self-service sign-up with Gmail, you should [test your line-of-business native applications for compatibility](google-federation.md#deprecation-of-web-view-sign-in-support).
22
-
> - The email one-time passcode feature is now turned on by default for all new tenants and for any existing tenants where you haven't explicitly turned it off. Learn more about [configuring email one-time passcode](one-time-passcode.md) and [plans for other fallback authentication methods](one-time-passcode.md#disable-email-one-time-passcode), such as unmanaged ("viral") accounts and Microsoft accounts.
21
+
> - **Starting January 4, 2021**, Google is [deprecating WebView sign-in support](https://developers.googleblog.com/2020/08/guidance-for-our-effort-to-block-less-secure-browser-and-apps.html). If you're using Google federation or self-service sign-up with Gmail, you should [test your line-of-business native applications for compatibility](google-federation.md#deprecation-of-web-view-sign-in-support).
22
+
> - The [email one-time passcode](one-time-passcode.md) feature is now turned on by default for all new tenants and for any existing tenants where you haven't explicitly turned it off. When this feature is turned off, the fallback authentication method is to prompt invitees to create a Microsoft account.
0 commit comments