Azure AD Add, not invite, External User as Member, Not Guest

user_326518 0
Viewed 7167

When Azure AD finally moved to the new portal, Microsoft quietly took away the button to add an external user (from another Azure AD or a MS account) directly. Now the only option seems to be to invite users as guests and send them an email link. This also denotes them with a UserType of Guest.

This is prohibitive in a B2C or multi-tenant intranet scenario. We can’t have to email invites around to get people added across directories. Adding users via a B2B spreadsheet import doesn’t seem to get them added as a non Guest either.

azure-active-directory
1 Answers

With the Azure AD B2B invitation options in Microsoft Graph, you can choose whether or not to send the invitation email, and whether to add the user as a Guest or as a Member. The New-AzureADMSInvitation cmdlets from the AzureAD PowerShell module is just a simple wrapper around this API, so the same capabilities are available in PowerShell.

Invite a user as member without sending email

With Microsoft Graph:

POST https://graph.microsoft.com/v1.0/invitations

{
  "invitedUserEmailAddress": "user@example.com",
  "inviteRedirectUrl": "https://example.com",
  "sendInvitationMessage": false,
  "invitedUserType": "Member"
}

With Azure AD PowerShell:

New-AzureADMSInvitation -InvitedUserEmailAddress "user@example.com" `#`
                        -InviteRedirectUrl "https://example.com" `#`
                        -SendInvitationMessage $false `#`
                        -InvitedUserType "Member"

Once the invitation has been created, the user can directly try to sign in to any tenant-specific application they have access to (e.g. https://contoso.sharepoint.com, or https://portal.azure.com/contoso.onmicrosoft.com, or https://yourapp.example.com), using the invited email address as their username.

The first time they do this, Azure AD will automatically detect them as an external user with a pending invitation, and proceed with the required consent prompt to complete the invitation acceptance. Subsequent sign-ins will allow the user to sign in directly. This is described in Add B2B collaboration guest users without an invitation.

user_3256970
Related