Shared channels across companies: four gates

Bringing someone from another company into a Teams shared channel goes through four gates: a Teams policy, the guest settings, cross-tenant access in both tenants, and MFA trust when Conditional Access requires MFA. Microsoft maps the errors users see to the settings behind them. Microsoft's page on shared channels errors

Gate 1: the Teams policy

In the Teams admin center, under Teams policies, the policy assigned to the person sending the invite needs Invite external users to shared channels set to On. When it's off, they see "Due to admin policy, you can't add external people to the channel." Microsoft's page on shared channels errors

Gate 2: the guest settings

Shared channels with external participants don't use guest accounts, but guest access in Teams still has to be on to invite them. Microsoft's page on shared channels

Teams uses Microsoft 365 Groups for team membership, so the Groups guest settings have to be on too: in the Microsoft 365 admin center, under Settings, Org settings, Microsoft 365 Groups, both Let group owners add people outside your organization to Microsoft 365 Groups as guests and Let guest group members access group content. With them off, the error is the same one with "For more info, talk to your admin." on the end. Microsoft's page on shared channels errors

Gate 3: cross-tenant access, in both tenants

Microsoft Entra ID blocks B2B direct connect inbound and outbound by default for every external tenant, and B2B direct connect is possible only when both organizations allow it: your inbound settings and the other organization's outbound settings. Microsoft's B2B direct connect overview

When either side blocks it, users see "You can't share this channel with people from this org." Microsoft's page sends you first to your own inbound settings, then to the other organization's outbound settings. Microsoft's page on shared channels errors

Changing cross-tenant access settings takes at least the Security Administrator role, or a custom role. Microsoft's cross-tenant access overview

Gate 4: MFA trust, if Conditional Access requires MFA

If your Conditional Access policies require MFA, B2B direct connect with another organization needs your inbound trust settings to accept MFA claims from that organization. Microsoft's B2B direct connect overview

When the organization hosting the channel hasn't set that trust, the other organization's user sees error AADSTS90071 when they try to open the channel: an admin from the hosting organization must update its access settings to accept inbound multifactor authentication. Microsoft's B2B troubleshooting page

The account that never gets through

A guest. People with Microsoft Entra guest accounts in your organization can't be added to a shared channel, and neither can guests converted to members in their user type property. Microsoft's page on shared channels

External people join on their home accounts: with B2B direct connect, users from both organizations work together with their home credentials, without being added to each other's organizations as guests. Microsoft's B2B direct connect overview

The setup in both tenants

Chapter 9 of Governance, Guest Access, and Devices for Microsoft Teams Administrators covers shared channels and B2B direct connect: the setup in both tenants, the trust settings, and the role that changes them. The card below links it.