EXT-03: Restrict Guest Access to Allowlisted Domains

EXT-03 is a security control that at level 3, external collaboration is tightly controlled. only pre-approved partner organizations can access your tenant. this prevents social engineering and limits data exposure to vetted third parties. It requires that guest invitations are restricted to an allowlist of trusted domains and cross-tenant access policies block all other external tenants, external sharing in sharepoint/onedrive is restricted to allowed domains.

At Level 3, external collaboration is tightly controlled. Only pre-approved partner organizations can access your tenant. This prevents social engineering and limits data exposure to vetted third parties.

TrueConfig provides one-click remediation for EXT-03. Configures cross-tenant access policy to block B2B direct connect by default. Partner allowlisting requires manual configuration.

This control requires Azure AD Premium P1 (included in Microsoft 365 E3) or higher.

EXT-03 is included in the Maximum Security baseline (Level 3). This level is designed for high-security environments and regulated industries.