---
title: "Set Up Your Microsoft Entra ID Cross-Tenant Access Settings"
slug: "set-up-your-microsoft-entra-id-cross-tenant-access-settings"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/set-up-your-microsoft-entra-id-cross-tenant-access-settings"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up Your Microsoft Entra ID Cross-Tenant Access Settings

> [!NOTE]
> **Note:** Red Canary is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

To ensure your security is up-to-date, we recommend that all users set a **deny-all** policy in your Entra ID cross-tenant access settings. This process will block all access to your tenant, except for trusted third parties like Zscaler MDR, who require access to monitor your security. Follow these steps to set up this policy and add an exception for Zscaler MDR.

## What is a cross-tenant access setting?

Microsoft Entra organizations can use External ID cross-tenant access settings to manage how they collaborate with other Microsoft Entra organizations and other Microsoft Azure clouds through business-to-business (B2B) collaboration and B2B direct connect. Cross-tenant access settings give you granular control over collaboration with external Microsoft Entra organizations. They govern inbound, which is how others collaborate with you, and outbound access, which is how your users collaborate with external Microsoft Entra organizations.

For more information, see [Overview: Cross-tenant access with Microsoft Entra External ID](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview).

## Configure a policy allowing Zscaler MDR’s security operations team to access your tenant

1. Log into your [Microsoft Entra dashboard](https://entra.microsoft.com/#home).
2. From the search bar, type and then click **External Identities**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(254).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
3. From the navigation pane, click **Cross-tenant access settings**.
4. Click **Add Organization**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image%20(22).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
5. From the search bar, type **redcanary.com**. The tenant ID should be **7262c62d-8d32-4595-8d19-893ab6cb8d5c***.*

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image (21).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
6. Click **Add**.
7. From the inbound access column, click **Inherited from Default** to view the Red Canary Root - redcanary.com name.

> [!NOTE]
> Note
> 
> You may receive an invitation from **Red Canary Microsoft Production** instead of **Red Canary Root - redcanary.com**. This is expected because Red Canary uses multiple tenants for data segmentation and security. Our **Red Canary Root - redcanary.com** tenant is where all our user accounts reside. However, for services like MDE integration, invitations are sent from our **Red Canary Microsoft Production** tenant. This allows us to ensure that only specific, authorized personnel (like Threat Hunters, Detection Engineers, and Technical Implementation Managers) are granted access to your environment, adhering to the principle of least privilege.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image (19).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
8. From the B2B collaboration section select **Customize settings**.
9. From the Access status section, select **Allow Access**.
10. From the Applies to section, select **Select Red Canary Root - redcanary.com user and groups**.
11. Click **Add external users and groups**.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image (19)(1).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
12. Enter **ddb64faa-bd9c-4c9e-aba4-e3ce02dbd01c**. This group includes Zscaler MDR Threat Hunting, Detection Engineers, Technical Implementation Managers, and Technical Support Engineers.
13. From the dropdown select **group**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(259).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
14. Click the **Applications** tab.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(260).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
15. From the Access Status section, select **Allow access**.
16. From the Applies To section, select **All applications**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(261).png?sv=2026-02-06&spr=https&st=2026-11-04T18%3A23%3A07Z&se=2026-11-04T19%3A23%3A07Z&sr=c&sp=r&sig=TScl2ImZWB38UEjY033Q3Itge4JzUubl3BZCkd8cOlg%3D)
17. From the **Trust settings** tab, select **Customize Settings** and enable the following settings:
  - **Trust multifactor authentication from Microsoft Entra tenants**: Allows your Conditional Access policies to trust MFA claims from Zscaler MDR.
  - **Trust compliant devices**: Allows your Conditional Access policies to trust compliant device claims from Zscaler MDR when our team accesses your resources.
18. Click **Save**.