Harbour ITMenu

Powered by Office Sentry 2.4.1

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Clients/Northwind Traders

Northwind Traders

northwindtraders.onmicrosoft.com
Monthly review

Trusted organisations and locations

What other organisations' people can do here and whose MFA the tenant accepts (cross-tenant access), and the named locations Conditional Access trusts or blocks, with the policies using each.

All clients
Download PDFXLSX
Own settings
2
Organisations with settings of their own
Outside MFA trusted
Yes
By default, from every organisation
Trusted locations
2
IP ranges marked trusted
Locations not used
4
No policy includes or leaves them out
Default for other organisations 5Organisations with their own settings 2Named locations 4

Default for other organisations 5

1 to review CSV

What applies to every organisation without settings of its own. B2B collaboration is guest accounts; B2B direct connect is Teams shared channels without a guest account. Trusting another organisation's MFA or devices lets its people pass your Conditional Access with checks made at home.

SettingTheir people here (inbound)Your people there (outbound)
B2B collaborationAllowed for all users, all appsAllowed for all users, all apps
B2B direct connectBlockedBlocked
Trust their MFA mediumYes
Trust their compliant devicesNo
Trust their hybrid joined devicesNo

Organisations with their own settings 2

CSV

Organisations given settings of their own, which replace the default for them. "Default" means that setting follows the default above. Microsoft gives each organisation's tenant ID, not its name: the Entra admin centre names them under External Identities > Cross-tenant access settings.

Tenant IDRelationshipB2B collaboration inB2B collaboration outDirect connect inDirect connect outTrusts their MFATrusts their devices
11111111-1111-1111-1111-111111111111Service providerDefaultDefaultDefaultDefaultYesCompliant
22222222-2222-2222-2222-222222222222DefaultBlockedAllowed for 2 users or groups, Office 365DefaultDefaultDefault

Named locations 4

1 to review CSV

Networks and countries Conditional Access policies can include or leave out. A trusted location counts as one of "all trusted locations", which policies often leave out of MFA, so a wide range marked trusted (wider than /16 for IPv4 or /32 for IPv6) or left out of a policy is flagged.

LocationKindTrustedRanges or countriesUsed byLast changed
Head officeIP rangesYes203.0.113.0/24Not used10 Feb 2026
Old VPN mediumIP rangesYes51.0.0.0/8, 2001:db8::/32Not used1 Jun 2021
Test labIP rangesNo10.0.0.0/8Not used1 Jan 2024
United KingdomCountriesNoGBNot used1 Mar 2025

From the tenant's cross-tenant access settings and Conditional Access named locations. Trusting another organisation's MFA is safest for named partners only, not as the default.

Data from Sharing and consent settings (), Conditional Access ().