Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Policies.cross Tenant Access Policy API

The policies.crossTenantAccessPolicy API from Microsoft Entra ID (formerly Azure AD) — 13 operation(s) for policies.crosstenantaccesspolicy.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 30

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /policies/crossTenantAccessPolicy View the tenant's cross-tenant access policy · Get crossTenantAccessPolicy #
Ask an LLM
“How do I see my tenant's overall cross-tenant access policy in Microsoft Entra ID?”
“Which cloud endpoints are allowed in our cross-tenant access policy right now?”
Tell an agent
Show me the top-level cross-tenant access policy for our tenant.
Get the cross-tenant access policy and include only {fields}.
PATCH /policies/crossTenantAccessPolicy Update the top-level cross-tenant access policy · Update crossTenantAccessPolicy #
Ask an LLM
“Can I change which cloud endpoints are allowed for cross-tenant collaboration?”
“How do I edit the overall cross-tenant access policy object itself?”
Tell an agent
Set the allowed cloud endpoints on our cross-tenant access policy to {endpoints}.
Patch the top-level cross-tenant access policy so collaboration with other clouds is limited to the ones I list.
DELETE /policies/crossTenantAccessPolicy Delete the cross-tenant access policy object · Delete navigation property crossTenantAccessPolicy for policies #
Ask an LLM
“Can the whole cross-tenant access policy object be deleted from the policies root?”
“What happens if I remove the entire cross-tenant access policy rather than one partner?”
Tell an agent destructive · confirm first
Delete the entire cross-tenant access policy object from our tenant's policies.
Remove the whole cross-tenant access policy only if its ETag still matches {etag}.
GET /policies/crossTenantAccessPolicy/default View the default cross-tenant access settings · Get crossTenantAccessPolicyConfigurationDefault #
Ask an LLM
“What are the default inbound and outbound B2B settings that apply to tenants without a partner config?”
“Is our cross-tenant default still the service default or has it been customized?”
Tell an agent
Show the default cross-tenant access configuration for tenants that have no partner-specific settings.
Get the cross-tenant default configuration returning only {fields}.
PATCH /policies/crossTenantAccessPolicy/default Change default cross-tenant access settings · Update crossTenantAccessPolicyConfigurationDefault #
Ask an LLM
“How can I block outbound B2B collaboration by default for every external tenant?”
“Can I trust MFA claims from all external tenants by default?”
Tell an agent
Update the default B2B collaboration inbound settings to {settings}.
Change the default inbound trust for all external tenants to {trust}.
DELETE /policies/crossTenantAccessPolicy/default Delete the default cross-tenant configuration · Delete navigation property default for policies #
Ask an LLM
“Can I delete the default configuration object under the cross-tenant access policy?”
“Is there a delete call for the cross-tenant default settings navigation property?”
Tell an agent destructive · confirm first
Delete the default configuration from our cross-tenant access policy.
Remove the cross-tenant default configuration if its ETag matches {etag}.
POST /policies/crossTenantAccessPolicy/default/microsoft.graph.resetToSystemDefault Reset default cross-tenant settings to system default · Invoke action resetToSystemDefault #
Ask an LLM
“How do I undo all my customizations to the default cross-tenant access settings?”
“Can I put the cross-tenant default configuration back to what Microsoft ships?”
Tell an agent destructive · confirm first
Reset our default cross-tenant access configuration back to the system default.
Discard every change to the cross-tenant default settings and restore the service default.
GET /policies/crossTenantAccessPolicy/partners List partner-specific cross-tenant configurations · List partners #
Ask an LLM
“Which external tenants have their own partner configuration in our cross-tenant access policy?”
“Can I list partner configurations along with their user synchronization policies?”
Tell an agent
List every partner configuration in our cross-tenant access policy.
List cross-tenant partner configurations matching {filter}.
POST /policies/crossTenantAccessPolicy/partners Add a partner tenant to cross-tenant access · Create crossTenantAccessPolicyConfigurationPartner #
Ask an LLM
“How do I set custom B2B settings for one specific external tenant?”
“Can I mark a partner tenant as a service provider when I add it?”
Tell an agent
Create a partner configuration for tenant {tenantId}.
Add partner tenant {tenantId} with inbound trust set to {trust}.
GET /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId} Get one partner's cross-tenant configuration · Get crossTenantAccessPolicyConfigurationPartner #
Ask an LLM
“What cross-tenant settings have we configured for a particular partner tenant?”
“Does a specific partner tenant have inbound MFA trust enabled?”
Tell an agent
Show the partner configuration for tenant {tenantId}.
Get the inbound trust settings configured for partner tenant {tenantId}.
PATCH /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId} Update a partner's cross-tenant settings · Update crossTenantAccessPolicyConfigurationPartner #
Ask an LLM
“Can I change B2B direct connect settings for one partner tenant I already configured?”
“How would I turn on automatic user consent for an existing partner tenant?”
Tell an agent
Update B2B direct connect inbound for partner {tenantId} to {settings}.
Set automatic user consent settings for existing partner {tenantId} to {consent}.
DELETE /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId} Remove a partner's cross-tenant configuration · Delete crossTenantAccessPolicyConfigurationPartner #
Ask an LLM
“How do I remove the custom settings for a partner tenant so it falls back to defaults?”
“Do I need to delete a partner's user sync policy before deleting the partner configuration?”
Tell an agent destructive · confirm first
Delete the partner configuration for tenant {tenantId}.
Remove partner tenant {tenantId} from our cross-tenant access policy.
GET /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId}/identitySynchronization Get a partner's user synchronization policy · Get crossTenantIdentitySyncPolicyPartner #
Ask an LLM
“Is user synchronization from a partner tenant into ours turned on?”
“What cross-tenant sync policy is set for a given partner?”
Tell an agent
Show the user synchronization policy for partner tenant {tenantId}.
Check whether inbound user sync is allowed from partner {tenantId}.
PUT /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId}/identitySynchronization Create a partner's user synchronization policy · Create identitySynchronization #
Ask an LLM
“How do I allow users from a partner tenant to be synced into our directory?”
“Can I name the cross-tenant sync policy when I create it for a partner?”
Tell an agent
Create a user sync policy for partner {tenantId} with inbound sync set to {userSyncInbound}.
Set up cross-tenant user synchronization for partner {tenantId} named {name}.
DELETE /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId}/identitySynchronization Delete a partner's user synchronization policy · Delete crossTenantIdentitySyncPolicyPartner #
Ask an LLM
“How do I stop syncing users in from a partner tenant?”
“Can I remove a partner's sync policy without deleting the partner configuration itself?”
Tell an agent destructive · confirm first
Delete the user synchronization policy for partner {tenantId}.
Turn off cross-tenant user sync from partner {tenantId} by removing its sync policy.
GET /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId}/serviceProviderConstraints Get a partner's service provider constraints · Get serviceProviderConstraints from policies #
Ask an LLM
“What service provider constraints apply to a partner tenant marked as a service provider?”
“Where can I read the service provider restrictions on a partner configuration?”
Tell an agent
Show the service provider constraints for partner tenant {tenantId}.
Get service provider constraints on partner {tenantId} returning only {fields}.
PATCH /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId}/serviceProviderConstraints Update a partner's service provider constraints · Update the navigation property serviceProviderConstraints in policies #
Ask an LLM
“How do I modify the service provider constraints on an existing partner tenant?”
“Can service provider constraints be patched separately from the rest of the partner config?”
Tell an agent
Update the service provider constraints for partner tenant {tenantId}.
Patch the service provider constraint object on partner {tenantId}.
DELETE /policies/crossTenantAccessPolicy/partners/{crossTenantAccessPolicyConfigurationPartner-tenantId}/serviceProviderConstraints Remove a partner's service provider constraints · Delete navigation property serviceProviderConstraints for policies #
Ask an LLM
“Can I clear the service provider constraints from a partner tenant configuration?”
“Is it possible to drop service provider restrictions for one partner?”
Tell an agent destructive · confirm first
Delete the service provider constraints for partner tenant {tenantId}.
Clear service provider restrictions on partner {tenantId}.
GET /policies/crossTenantAccessPolicy/partners/$count Count partner cross-tenant configurations · Get the number of the resource #
Ask an LLM
“How many external tenants have partner-specific cross-tenant settings?”
“Can I count only the partner configurations matching a filter?”
Tell an agent
Count the partner configurations in our cross-tenant access policy.
Count cross-tenant partner configurations that match {filter}.
GET /policies/crossTenantAccessPolicy/templates View multitenant organization policy templates · Get templates from policies #
Ask an LLM
“What base policy templates exist for our multitenant organization settings?”
“Can I see both multitenant org templates in a single call?”
Tell an agent
Show the cross-tenant access policy templates container for our multitenant organization.
Get the multitenant organization templates and expand {relationship}.
PATCH /policies/crossTenantAccessPolicy/templates Update the multitenant organization templates container · Update the navigation property templates in policies #
Ask an LLM
“Can I update both the identity sync and partner configuration templates together?”
“How do I patch the multitenant organization templates container as a whole?”
Tell an agent
Update the templates container with partner configuration template {template}.
Patch the templates container setting the identity sync template to {template}.
DELETE /policies/crossTenantAccessPolicy/templates Delete the multitenant organization templates · Delete navigation property templates for policies #
Ask an LLM
“Is there a way to delete the templates container under the cross-tenant access policy?”
“Can the multitenant organization base policy templates be removed?”
Tell an agent destructive · confirm first
Delete the templates container from our cross-tenant access policy.
Remove the multitenant organization templates container if its ETag matches {etag}.
GET /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization Get the multitenant org user sync template · Get multiTenantOrganizationIdentitySyncPolicyTemplate #
Ask an LLM
“What user synchronization settings does our multitenant organization template apply?”
“Which tenants does the multitenant org identity sync template apply to?”
Tell an agent
Show the multitenant organization identity synchronization template.
Get the user sync template for our multitenant org with only {fields}.
PATCH /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization Update the multitenant org user sync template · Update multiTenantOrganizationIdentitySyncPolicyTemplate #
Ask an LLM
“How do I enable inbound user sync in the multitenant organization template?”
“Can I control which tenants the multitenant org sync template is applied to?”
Tell an agent
Set inbound user sync in the multitenant org identity sync template to {userSyncInbound}.
Change the application level of the multitenant org user sync template to {level}.
DELETE /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization Delete the multitenant org user sync template · Delete navigation property multiTenantOrganizationIdentitySynchronization for… #
Ask an LLM
“Can I delete the identity synchronization template for our multitenant organization?”
“Is the multitenant org user sync template something I can remove outright?”
Tell an agent destructive · confirm first
Delete the multitenant organization identity synchronization template.
Remove the multitenant org user sync template if its ETag matches {etag}.
POST /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization/microsoft.graph.resetToDefaultSettings Reset the multitenant org user sync template · Invoke action resetToDefaultSettings #
Ask an LLM
“How do I restore the multitenant org identity sync template to its default values?”
“Can I undo my edits to the user synchronization template for our multitenant organization?”
Tell an agent destructive · confirm first
Reset the multitenant organization identity synchronization template to default settings.
Restore default values on our multitenant org user sync template.
GET /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration Get the multitenant org partner config template · Get multiTenantOrganizationPartnerConfigurationTemplate #
Ask an LLM
“What inbound and outbound partner settings does our multitenant organization template set?”
“Does the multitenant org partner template trust MFA from member tenants?”
Tell an agent
Show the multitenant organization partner configuration template.
Get the multitenant org partner configuration template returning {fields}.
PATCH /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration Update the multitenant org partner config template · Update multiTenantOrganizationPartnerConfigurationTemplate #
Ask an LLM
“How do I change B2B collaboration settings in the multitenant organization partner template?”
“Can I turn on automatic user consent across our multitenant organization via its template?”
Tell an agent
Set B2B collaboration outbound in the multitenant org partner template to {settings}.
Update inbound trust in the multitenant org partner template to {trust}.
DELETE /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration Delete the multitenant org partner config template · Delete navigation property multiTenantOrganizationPartnerConfiguration for… #
Ask an LLM
“Can the partner configuration template for our multitenant organization be deleted?”
“Is there a delete for the multitenant org inbound and outbound partner template?”
Tell an agent destructive · confirm first
Delete the multitenant organization partner configuration template.
Remove the multitenant org partner template if its ETag matches {etag}.
POST /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration/microsoft.graph.resetToDefaultSettings Reset the multitenant org partner config template · Invoke action resetToDefaultSettings #
Ask an LLM
“How can I put the multitenant org partner configuration template back to defaults?”
“Can I undo changes to the inbound and outbound template for our multitenant organization?”
Tell an agent destructive · confirm first
Reset the multitenant organization partner configuration template to default settings.
Restore default values on our multitenant org partner template.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://artifacts.apis.io/azure-ad/openapi/azure-ad-policies-crosstenantaccesspolicy-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-cross-tenant-access-policy-configuration-partner-schema.json
📊
JSONSchema
https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-cross-tenant-access-policy-configuration-default-schema.json
📊
JSONSchema
https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-multi-tenant-organization-partner-configuration-template-schema.json
📊
JSONSchema
https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-cross-tenant-access-policy-schema.json
📊
JSONSchema
https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-cross-tenant-identity-sync-policy-partner-schema.json
📊
JSONSchema
https://artifacts.apis.io/azure-ad/json-schema/azure-ad-microsoft-graph-policy-template-schema.json

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://artifacts.apis.io/azure-ad/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-policies-crosstenantaccesspolicy-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-policies-crosstenantaccesspolicy-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Identity.SignIns Policies.cross Tenant Access Policy API
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (54 KB total) ---
# Full source: https://artifacts.apis.io/azure-ad/openapi/azure-ad-policies-crosstenantaccesspolicy-api-openapi.yml