Delegate Administration To Partners Using Azure AD B2B Collaboration

Azure Active Directory (Azure AD) B2B collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. With B2B collaboration, you can securely share your company's applications and services with external users, while maintaining control over your own corporate data. Work safely and securely with external partners, large or small, even if they don't have Azure AD or an IT department.

A simple invitation and redemption process lets partners use their own credentials to access your company's resources. You can also enable self-service sign-up user flows to let external users sign up for apps or resources themselves. Once the external user has redeemed their invitation or completed sign-up, they're represented in your directory as a user object. B2B collaboration user objects are typically given a user type of "guest" and can be identified by the #EXT# extension in their user principal name.

Download File

For example, business partner visibility into inventory management systems, CRM, marketing, O365, and even HR applications is necessary to ease the flow of the business partnerships and allow for collaboration on projects.

The twist: we need to delegate user management to our partners/vendors. So as an example, for app3 we will have tons of partner/vendor organizations that need access. We want to give 1 person from that organization the responsibility of inviting their colleagues and removing folks when anyone leaves their organization. In many cases, they won't necessarily have the same email address domains so we can't restrict/group in that manner. In other cases, we need each national office of a global organization to have its own delegated admin to manage staff so there may be separate organizations with users that have the same email address domain.

My questions: Is Azure AD B2C the right approach for this? Can it support this kind of delegated management (something like -us/azure/active-directory/active-directory-accessmanagement-self-service-group-management)?

Use Azure AD and the B2B collaboration feature (including its ability to delegate invitations). This also opens up the self-service group management capabilities you referenced. If you don't want these users to get access to other things in your organization, you would probably want to create a separate Azure AD tenant for this and also invite people from your on Azure AD via B2B collaboration.

More and more organizations are using Azure AD B2B collaboration capabilities to connect with other organizations. This post from Alex Simons announces three important improvements to the B2B collaboration experience that not only improve the end-to-end experience of partner users accessing your resources, but also help support your organization's obligations under the GDPR.

This article touches on the key properties of an Azure AD B2B collaboration user. Learn how an Azure AD B2B user can be added as a member instead of a guest. Use a filter to see only guest users in the directory. Convert the UserType from member to guest and vice versa using PowerShell. And see how guest user limitations can be removed.

Azure AD entitlement management works with Azure AD B2B to enable collaboration across business partners. Employees from a business partner can request access to resources using the same access packages and our policy engine, including provisioning their accounts upon approval by a business sponsor. This makes it simple to grant access to a specified set of resources for your business partners while knowing your processes are compliant and secure.

Previously I have written about using Microsoft Identity Manager to automate the process of performing B2B Guest Invites. Potentially MIM could be used to convert external partners accounts to B2B Members (not covered in this post).

To allow Azure AD to manage non-admin users only, it's sufficient to makethe azuread-provisioning user a delegated administrator. As a delegatedadministrator, Azure AD can't manage other delegated administratorsor super-admin users.

Most system administrators at one point or another have had the need to grant third party access to a businesses resource for either support or collaboration reasons. This probably involved creating a new account within the local AD and then permissioning the application using the newly created account.

Let say, if you are using office 365, Azure or Dynamic 365, you are not realizing that you are already using azure AD. Every office365, Azure and Dynamics 365 tenant already an azure AD tenant. When you want to start using that tenant to manage access to thousands of other cloud applications Azure AD integrates with it.

Rather than using Power Apps Portals authentication and managing a different set of user identities in the application, we chose to delegate this responsibility to AAD B2C. We made this decision because AAD B2C:

Through AAD B2C identity providers, we can onboard multiple partners or vendors for business-to-business collaboration. We can securely share the enterprise applications with guest users from any other organization while maintaining control over their access. It works safely and securely with external partners, even if they do not use Azure AD. Whereas managing multiple B2B settings in the Portals app will be cumbersome, if not impossible.

LoginRadius B2B Identity lets you delegate admin access to your customers and partners for seamlessly managing their employees and users. Consequently, it saves the efforts and time of your IT support team.

For example: Login with Salesforce for one customer and Login with Azure AD for another customer. So, customers and partners can easily authenticate using their identity provider rather than creating a new identity.

As organizations focus more on their core business, the need to partner with other businesses increases. Organizations need to easily and securely share resources (such as access to corporate applications) with their partners to engage in effective collaboration.

The partner companies or people who need access to your corporate applications do not need to have Azure AD. Azure AD B2B collaboration provides a simple user signup experience to provide these partners with immediate access to your applications.

Identity and access control management is at the core of each and every one these collaborations: you need to give your business partners access to key applications and data, but you also need to make sure these assets don't end up in the hands of the wrong people.

Azure AD B2B collaboration provides simplified management and security for partners and other external users accessing your in-house resources using Azure AD as the control plane. This includes access to popular SaaS apps such as Office 365, Salesforce, Dropbox, Workday, etc., many Azure services, and other mobile, cloud, and on-premises claims-aware applications.

Azure AD B2B collaboration is a new set of capabilities that enable simple and secure collaboration with your business partners. Azure AD B2B collaboration is easy to configure with simplified signup for partners of all sizes even if they don't have their own Azure AD via an email-verified process. It is also easy to maintain with no external directories or per partner federation configurations.

Azure AD B2B collaboration allows you to setup business-to-business collaboration with partners of all sizes, whether they already use Azure AD or not. For business partners that don't already have Azure AD, and/or for partners with no IT infrastructure at all, Azure AD B2B collaboration has a streamlined signup experience to provide Azure AD or MSA accounts to your business partners as explained above.

The Azure AD PowerShell V2 module provides a set of cmdlets specifically designed for Azure AD tenant-based administration. So, thanks to a PowerShell interface, you can administer your Azure AD tenant using Windows PowerShell and you can complete common configuration tasks and manage your organization data.

As mentioned earlier, for business partners with valid business email addresses who don't already have Azure AD, Azure B2B collaboration provides a streamlined self-service sign-up experience to provide Azure AD accounts to these guest users. An unmanaged tenant will be created for that purpose.

The course concludes with an in-depth examination of Microsoft 365 identity synchronization, with a focus on Azure Active Directory Connect. You will learn how to plan for and implement Azure AD Connect, how to manage synchronized identities, and how to implement password management in Microsoft 365 using multi-factor authentication and self-service password management. This section wraps up with a comprehensive look at implementing application and external access. You will learn how to add and manage applications in Azure Active Directory, including how to configure multi-tenant applications. You will then examine how to configure Azure AD Application Proxy, including how to install and register a connector and how to publish an on-premises app for remote access. Finally, you will examine how to design and manage solutions for external access. This includes licensing guidance for Azure AD B2B collaboration, creating a collaborative user, and troubleshooting a B2B collaboration.

By now I assume you have idea what is Azure AD and how it works. If you are new to my blog, please search for Azure AD on my blog and you will be able to find articles explaining about it and its capabilities. Azure AD manage identities for the company and it will allow to control access to resources such as applications. Sometime based on business requirements companies have to share their resources with partners, other companies in group etc. in such scenario Azure AD B2B collaboration supports to share resources with another party using their own identities.

Using Azure AD B2B partners can use Azure AD account they create using the invitation process. Then azure admins can control the access to the applications. Once the tasks are completed those accounts easily can remove from the azure AD and all the permissions to the resources will be revoked. The partner company do not need to have any azure subscription and it allow to provide quick access to the resource with minimum changes.

d0d94e66b7