ESC
Type to search...

Policy.ReadWrite.CrossTenantAccess

Export JSON
Export CSV
Copy URL
Print
ApplicationDelegated Read/Write User Scope

Allows the app to read and write your organization's cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.

Permission data: April 6, 2026 at 4:06 AM UTC
Delegated Access App-Only Access

Permission Details

Application Permission

Read and write your organization's cross tenant access policies

Allows the app to read and write your organization's cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.

Delegated Permission Admin consent required

Read and write your organization's cross tenant access policies

Allows the app to read and write your organization's cross-tenant access policies and configuration for automatic user consent settings to suppress consent prompts for users of the other tenant on behalf of the signed-in user.

Properties

Microsoft Graph v1.0 mapped-docs

Properties is shown from stable Microsoft Graph v1.0 metadata.

Property Type Description
id String Unique identifier of the policy. Inherited from entity.
activityBasedTimeoutPolicies activityBasedTimeoutPolicy collection The policy that controls the idle time out for web sessions for applications.
adminConsentRequestPolicy object The policy by which consent requests are created and managed for the entire tenant.
appManagementPolicies appManagementPolicy collection The policies that enforce app management restrictions for specific applications and service principals, overriding the defaultAppManagementPolicy.
authenticationFlowsPolicy object The policy configuration of the self-service sign-up experience of external users.
authenticationMethodsPolicy object The authentication methods and the users that are allowed to use them to sign in and perform multifactor authentication (MFA) in Microsoft Entra ID.
authenticationStrengthPolicies authenticationStrengthPolicy collection The authentication method combinations that are to be used in scenarios defined by Microsoft Entra Conditional Access.
authorizationPolicy object The policy that controls Microsoft Entra authorization settings.
claimsMappingPolicies claimsMappingPolicy collection The claim-mapping policies for WS-Fed, SAML, OAuth 2.0, and OpenID Connect protocols, for tokens issued to a specific application.
conditionalAccessPolicies conditionalAccessPolicy collection The custom rules that define an access scenario.
crossTenantAccessPolicy object The custom rules that define an access scenario when interacting with external Microsoft Entra tenants.
defaultAppManagementPolicy object The tenant-wide policy that enforces app management restrictions for all applications and service principals.
deviceRegistrationPolicy object
featureRolloutPolicies featureRolloutPolicy collection The feature rollout policy associated with a directory object.
homeRealmDiscoveryPolicies homeRealmDiscoveryPolicy collection The policy to control Microsoft Entra authentication behavior for federated users.

Showing 15 of 21 properties.

JSON Representation

Microsoft Graph v1.0 mapped-docs

JSON representation is shown from stable Microsoft Graph v1.0 metadata.

JSON representation
{
  "@odata.type": "#microsoft.graph.policyRoot",
  "id": "String (identifier)"
}

Relationships

Microsoft Graph v1.0 mapped-docs

Relationships is shown from stable Microsoft Graph v1.0 metadata.

Relationship Type Description
activityBasedTimeoutPolicies activityBasedTimeoutPolicy collection The policy that controls the idle time out for web sessions for applications.
adminConsentRequestPolicy adminConsentRequestPolicy The policy by which consent requests are created and managed for the entire tenant.
appManagementPolicies appManagementPolicy collection The policies that enforce app management restrictions for specific applications and service principals, overriding the defaultAppManagementPolicy.
authenticationFlowsPolicy authenticationFlowsPolicy The policy configuration of the self-service sign-up experience of external users.
authenticationMethodsPolicy authenticationMethodsPolicy The authentication methods and the users that are allowed to use them to sign in and perform multifactor authentication (MFA) in Microsoft Entra ID.
authenticationStrengthPolicies authenticationStrengthPolicy collection The authentication method combinations that are to be used in scenarios defined by Microsoft Entra Conditional Access.
authorizationPolicy authorizationPolicy collection The policy that controls Microsoft Entra authorization settings.
claimsMappingPolicies claimsMappingPolicy collection The claim-mapping policies for WS-Fed, SAML, OAuth 2.0, and OpenID Connect protocols, for tokens issued to a specific application.
conditionalAccessPolicies conditionalAccessPolicy The custom rules that define an access scenario.
crossTenantAccessPolicy crossTenantAccessPolicy The custom rules that define an access scenario when interacting with external Microsoft Entra tenants.
defaultAppManagementPolicy tenantAppManagementPolicy The tenant-wide policy that enforces app management restrictions for all applications and service principals.
featureRolloutPolicies featureRolloutPolicy collection The feature rollout policy associated with a directory object.
homeRealmDiscoveryPolicies homeRealmDiscoveryPolicy collection The policy to control Microsoft Entra authentication behavior for federated users.
identitySecurityDefaultsEnforcementPolicy identitySecurityDefaultsEnforcementPolicy The policy that represents the security defaults that protect against common attacks.
permissionGrantPolicies permissionGrantPolicy collection The policy that specifies the conditions under which consent can be granted.
roleManagementPolicies unifiedRoleManagementPolicy collection Specifies the various policies associated with scopes and roles.
roleManagementPolicyAssignments unifiedRoleManagementPolicyAssignment collection The assignment of a role management policy to a role definition object.
tokenIssuancePolicies tokenIssuancePolicy collection The policy that specifies the characteristics of SAML tokens issued by Microsoft Entra ID.
tokenLifetimePolicies tokenLifetimePolicy collection The policy that controls the lifetime of a JWT access token, an ID token, or a SAML 1.1/2.0 token issued by Microsoft Entra ID.
b2bManagementPolicies b2bManagementPolicy collection The policy to manage Microsoft Entra B2B features in Microsoft Entra External ID for workforce tenants.
mobileAppManagementPolicies mobileAppManagementPolicy collection The policy that defines autoenrollment configuration for a mobility management (MDM or MAM) application.
mobileDeviceManagementPolicies mobileDeviceManagementPolicy collection Related mobileDeviceManagementPolicies data exposed by this resource.
onPremAuthenticationPolicies onPremAuthenticationPolicy collection The policy that controls how authentication requests from on-premises environments are managed.
permissionGrantPreApprovalPolicies permissionGrantPreApprovalPolicy collection Policies that specify the conditions under which consent can be granted to a specific application.
servicePrincipalCreationPolicies servicePrincipalCreationPolicy collection Related servicePrincipalCreationPolicies data exposed by this resource.

Graph Methods

Delegated access App-only access
Exact Microsoft Learn match

Microsoft Graph v1.0 endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /policies/crossTenantAccessPolicy
GET /policies/crossTenantAccessPolicy/default
GET /policies/crossTenantAccessPolicy/partners
GET /policies/crossTenantAccessPolicy/partners/{id}
GET /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
GET /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
GET /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
POST /policies/crossTenantAccessPolicy/default/resetToSystemDefault
POST /policies/crossTenantAccessPolicy/partners
POST /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings
POST /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings
PATCH /policies/crossTenantAccessPolicy
PATCH /policies/crossTenantAccessPolicy/default
PATCH /policies/crossTenantAccessPolicy/partners/{id}
PATCH /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
PATCH /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
PATCH /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
PUT /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
DELETE /policies/crossTenantAccessPolicy/partners/{id}
DELETE /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
Exact Microsoft Learn match

Microsoft Graph beta endpoints are mapped directly from refreshed Microsoft Learn permissions tables.

Methods
GET /policies/crossTenantAccessPolicy
GET /policies/crossTenantAccessPolicy/default
GET /policies/crossTenantAccessPolicy/partners
GET /policies/crossTenantAccessPolicy/partners/{id}
GET /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
GET /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
GET /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
POST /policies/crossTenantAccessPolicy/default/resetToSystemDefault
POST /policies/crossTenantAccessPolicy/partners
POST /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization/resetToDefaultSettings
POST /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration/resetToDefaultSettings
PATCH /policies/crossTenantAccessPolicy
PATCH /policies/crossTenantAccessPolicy/default
PATCH /policies/crossTenantAccessPolicy/partners/{id}
PATCH /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
PATCH /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
PATCH /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
PUT /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
DELETE /identity/conditionalAccess/deletedItems/namedLocations/{id}
DELETE /identity/conditionalAccess/deletedItems/policies/{id}
DELETE /policies/crossTenantAccessPolicy/partners/{id}
DELETE /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
DELETE /policies/deletedItems/crossTenantPartners/{id}
DELETE /policies/deletedItems/crossTenantSyncPolicyPartners/{id}
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell v1.0 commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgPolicyCrossTenantAccessPolicy /policies/crossTenantAccessPolicy
Get crossTenantAccessPolicy
Get-MgPolicyCrossTenantAccessPolicyDefault /policies/crossTenantAccessPolicy/default
Get crossTenantAccessPolicyConfigurationDefault
Get-MgPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners
List partners
Get-MgPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners/{id}
Get crossTenantAccessPolicyConfigurationPartner
Get-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
Get crossTenantIdentitySyncPolicyPartner
Get-MgPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationIdentitySynchronization /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
Get multiTenantOrganizationIdentitySyncPolicyTemplate
Get-MgPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationPartnerConfiguration /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
Get multiTenantOrganizationPartnerConfigurationTemplate
New-MgPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners
Create crossTenantAccessPolicyConfigurationPartner
Remove-MgPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners/{id}
Delete crossTenantAccessPolicyConfigurationPartner
Remove-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
Delete crossTenantIdentitySyncPolicyPartner
Set-MgPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
Create identitySynchronization
Update-MgPolicyCrossTenantAccessPolicy /policies/crossTenantAccessPolicy
Update crossTenantAccessPolicy
Update-MgPolicyCrossTenantAccessPolicyDefault /policies/crossTenantAccessPolicy/default
Update crossTenantAccessPolicyConfigurationDefault
Update-MgPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners/{id}
Update crossTenantAccessPolicyConfigurationPartner
Update-MgPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationIdentitySynchronization /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
Update multiTenantOrganizationIdentitySyncPolicyTemplate
Update-MgPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationPartnerConfiguration /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
Update multiTenantOrganizationPartnerConfigurationTemplate
Exact Microsoft Learn PowerShell match

Microsoft Graph PowerShell beta commands are mapped directly from refreshed Microsoft Learn PowerShell snippets.

Commands
Get-MgBetaPolicyCrossTenantAccessPolicy /policies/crossTenantAccessPolicy
Get crossTenantAccessPolicy
Get-MgBetaPolicyCrossTenantAccessPolicyDefault /policies/crossTenantAccessPolicy/default
Get crossTenantAccessPolicyConfigurationDefault
Get-MgBetaPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners
List partners
Get-MgBetaPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners/{id}
Get crossTenantAccessPolicyConfigurationPartner
Get-MgBetaPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
Get crossTenantIdentitySyncPolicyPartner
Get-MgBetaPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationIdentitySynchronization /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
Get multiTenantOrganizationIdentitySyncPolicyTemplate
Get-MgBetaPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationPartnerConfiguration /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
Get multiTenantOrganizationPartnerConfigurationTemplate
New-MgBetaPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners
Create crossTenantAccessPolicyConfigurationPartner
Remove-MgBetaIdentityConditionalAccessDeletedItemNamedLocation /policies/deletedItems/crossTenantPartners/{id}
Delete policyDeletableItem
Remove-MgBetaIdentityConditionalAccessDeletedItemPolicy /policies/deletedItems/crossTenantPartners/{id}
Delete policyDeletableItem
Remove-MgBetaPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners/{id}
Delete crossTenantAccessPolicyConfigurationPartner
Remove-MgBetaPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
Delete crossTenantIdentitySyncPolicyPartner
Remove-MgBetaPolicyDeletedItemCrossTenantPartner /policies/deletedItems/crossTenantPartners/{id}
Delete policyDeletableItem
Remove-MgBetaPolicyDeletedItemCrossTenantSyncPolicyPartner /policies/deletedItems/crossTenantPartners/{id}
Delete policyDeletableItem
Set-MgBetaPolicyCrossTenantAccessPolicyPartnerIdentitySynchronization /policies/crossTenantAccessPolicy/partners/{id}/identitySynchronization
Create identitySynchronization
Update-MgBetaPolicyCrossTenantAccessPolicy /policies/crossTenantAccessPolicy
Update crossTenantAccessPolicy
Update-MgBetaPolicyCrossTenantAccessPolicyDefault /policies/crossTenantAccessPolicy/default
Update crossTenantAccessPolicyConfigurationDefault
Update-MgBetaPolicyCrossTenantAccessPolicyPartner /policies/crossTenantAccessPolicy/partners/{id}
Update crossTenantAccessPolicyConfigurationPartner
Update-MgBetaPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationIdentitySynchronization /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationIdentitySynchronization
Update multiTenantOrganizationIdentitySyncPolicyTemplate
Update-MgBetaPolicyCrossTenantAccessPolicyTemplateMultiTenantOrganizationPartnerConfiguration /policies/crossTenantAccessPolicy/templates/multiTenantOrganizationPartnerConfiguration
Update multiTenantOrganizationPartnerConfigurationTemplate

Code Examples

C# / .NET SDK
Create crossTenantAccessPolicyConfigurationPartner
// Code snippets are only available for the latest version. Current version is 5.x

// Dependencies
using Microsoft.Graph.Models;

var requestBody = new CrossTenantAccessPolicyConfigurationPartner
{
	TenantId = "3d0f5dec-5d3d-455c-8016-e2af1ae4d31a",
	B2bDirectConnectOutbound = new CrossTenantAccessPolicyB2BSetting
	{
		UsersAndGroups = new CrossTenantAccessPolicyTargetConfiguration
		{
			AccessType = CrossTenantAccessPolicyTargetConfigurationAccessType.Blocked,
			Targets = new List<CrossTenantAccessPolicyTarget>
			{
				new CrossTenantAccessPolicyTarget
				{
					Target = "6f546279-4da5-4b53-a095-09ea0cef9971",
					TargetType = CrossTenantAccessPolicyTargetType.Group,
				},
			},
		},
	},
	B2bDirectConnectInbound = new CrossTenantAccessPolicyB2BSetting
	{
		Applications = new CrossTenantAccessPolicyTargetConfiguration
		{
			AccessType = CrossTenantAccessPolicyTargetConfigurationAccessType.Allowed,
			Targets = new List<CrossTenantAccessPolicyTarget>
			{
				new CrossTenantAccessPolicyTarget
				{
					Target = "Office365",
					TargetType = CrossTenantAccessPolicyTargetType.Application,
				},
			},
		},
	},
};

// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Policies.CrossTenantAccessPolicy.Partners.PostAsync(requestBody);
JavaScript
Create crossTenantAccessPolicyConfigurationPartner
const options = {
	authProvider,
};

const client = Client.init(options);

const crossTenantAccessPolicyConfigurationPartner = {
  tenantId: '3d0f5dec-5d3d-455c-8016-e2af1ae4d31a',
  b2bDirectConnectOutbound: 
  {
    usersAndGroups: 
    {
      accessType: 'blocked',
      targets: [
        {
            target: '6f546279-4da5-4b53-a095-09ea0cef9971',
            targetType: 'group'
        }
      ]
    }
  },
  b2bDirectConnectInbound: 
  {
    applications: 
    {
      accessType: 'allowed',
      targets: [
        {
            target: 'Office365',
            targetType: 'application'
        }
      ]
    }
  }
};

await client.api('/policies/crossTenantAccessPolicy/partners')
	.post(crossTenantAccessPolicyConfigurationPartner);
PowerShell
Create crossTenantAccessPolicyConfigurationPartner
Import-Module Microsoft.Graph.Identity.SignIns

$params = @{
	tenantId = "3d0f5dec-5d3d-455c-8016-e2af1ae4d31a"
	b2bDirectConnectOutbound = @{
		usersAndGroups = @{
			accessType = "blocked"
			targets = @(
				@{
					target = "6f546279-4da5-4b53-a095-09ea0cef9971"
					targetType = "group"
				}
			)
		}
	}
	b2bDirectConnectInbound = @{
		applications = @{
			accessType = "allowed"
			targets = @(
				@{
					target = "Office365"
					targetType = "application"
				}
			)
		}
	}
}

New-MgPolicyCrossTenantAccessPolicyPartner -BodyParameter $params
Python
Create crossTenantAccessPolicyConfigurationPartner
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.cross_tenant_access_policy_configuration_partner import CrossTenantAccessPolicyConfigurationPartner
from msgraph.generated.models.cross_tenant_access_policy_b2_b_setting import CrossTenantAccessPolicyB2BSetting
from msgraph.generated.models.cross_tenant_access_policy_target_configuration import CrossTenantAccessPolicyTargetConfiguration
from msgraph.generated.models.cross_tenant_access_policy_target_configuration_access_type import CrossTenantAccessPolicyTargetConfigurationAccessType
from msgraph.generated.models.cross_tenant_access_policy_target import CrossTenantAccessPolicyTarget
from msgraph.generated.models.cross_tenant_access_policy_target_type import CrossTenantAccessPolicyTargetType
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = CrossTenantAccessPolicyConfigurationPartner(
	tenant_id = "3d0f5dec-5d3d-455c-8016-e2af1ae4d31a",
	b2b_direct_connect_outbound = CrossTenantAccessPolicyB2BSetting(
		users_and_groups = CrossTenantAccessPolicyTargetConfiguration(
			access_type = CrossTenantAccessPolicyTargetConfigurationAccessType.Blocked,
			targets = [
				CrossTenantAccessPolicyTarget(
					target = "6f546279-4da5-4b53-a095-09ea0cef9971",
					target_type = CrossTenantAccessPolicyTargetType.Group,
				),
			],
		),
	),
	b2b_direct_connect_inbound = CrossTenantAccessPolicyB2BSetting(
		applications = CrossTenantAccessPolicyTargetConfiguration(
			access_type = CrossTenantAccessPolicyTargetConfigurationAccessType.Allowed,
			targets = [
				CrossTenantAccessPolicyTarget(
					target = "Office365",
					target_type = CrossTenantAccessPolicyTargetType.Application,
				),
			],
		),
	),
)

result = await graph_client.policies.cross_tenant_access_policy.partners.post(request_body)

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Application permissions or delegated permissions and search for Policy.ReadWrite.CrossTenantAccess

4

Grant Admin Consent

Application permissions always require admin consent.