Cascade Regional Airlines' cloud administrator is auditing external access and finds that the tenant's external collaboration settings allow any employee to invite guests from any domain with no restrictions, which the compliance officer considers too permissive for an airline handling sensitive maintenance data. What should the administrator do to tighten this while still allowing legitimate B2B collaboration?

Microsoft Entra ID's external collaboration settings let an admin control which internal users or roles are permitted to invite guests, and optionally allow-list or deny-list specific external domains, narrowing exposure without eliminating the B2B capability the business genuinely relies on for contractors and partners. That granular control is the mechanism that satisfies both goals at once: tighter governance and continued legitimate collaboration. Disabling B2B collaboration entirely is an overcorrection that would also block the external auditor and staffing-agency contractor scenarios the airline already depends on, trading one risk for a bigger operational gap. Converting every guest into a full internal member account is backwards from a least-privilege standpoint — it grants external parties a stronger identity footprint than they need and defeats the purpose of the lighter-weight guest model. Removing MFA for guest accounts moves security in the wrong direction entirely; it would make external accounts easier to compromise, which directly conflicts with the compliance officer's concern about sensitive data. An exam-relevant caveat: cross-tenant access settings offer even finer-grained control over trust with specific partner Entra ID tenants, which is worth layering on top of basic external collaboration restrictions for known partners. An operational check is attempting a guest invite from a non-allow-listed domain after the change and confirming it is blocked.