[MUSIC]
Maria Lai: Welcome. My name is Maria Lai and I am a Program
Manager in Azure AD B2B Collaboration.
Today, I’m going to talk to you about collaboration and
sharing with any partner using Azure AD B2B, a set of
capabilities built into Azure AD. B2B enables organizations
of all sizes to collaborate easily with any person on the
planet in a secure and trustworthy manner while maintaining
the compliance and governance requirements. Let me explain.
Let’s say you are a manager of a baker store chain in
WoodGrove and you need to work with your wheat wholesale
supplier to properly take inventory and stock your supplies.
In a world without B2B, there are two main ways for you to
share access to your inventory data with Adrian@AmazingWheat.com
by creating a local account within your directory and giving
Adrian the user name and password of this account. The
cons of this method is that an extra set of
credentials will have to protect an additional account for
you to manage and it de-associates Adrian’s access to his
relationship with his Amazing Wheat company.
If Adrian leaves the company, Adrian still has access to your
inventory data until he deletes his account. The second
ways is by sending Adrian a copy of your inventory data
by another means like email. The concept of this method
is that future changes to inventory are not propagated
and you cannot revoke access afterwards. And you do not
have control in who Adrian can share his information with.
So in a world with B2B, you can share your inventory data
with Adrian seamlessly and securely. Let me show you
how.
So in this diagram, we have WoodGrove representing your
company and Adrian in AmazingWheat.com. And Adrian
by using the B2B invitation manager API, we create a
shadow user object for Adrian in your directory, and you
can provision access to the director of information to Adrian
through this user object. At the same time, we link this
user object to Adrian’s home identity in AmazingWheat, so
that when he authenticates, hue authenticates with his
AmazingWheat.com account.
Let’s dive in deeper into how B2B decouples authorization
from authentication, reducing headaches for you so that
you only need to manage guest access and not guest
credentials. In this diagram, we have Adrian trying to
access the content you have shared with him in WoodGrove.
The content redirects for authentication and authorization.
WoodGrove recognizes the guests and redirects them to
AmazingWheat for authentication. AmazingWheat authenticates
the user and sends WoodGrove a token. WoodGrove
validates the token and sends the new token for Adrian to
access his content.
B2B is fully integrated into Office 365 apps, making it easy
for you to share and give your guests a rich set of experiences.
It also works seamlessly with custom apps and resources.
Guests are just users in Azure AD. Apps and resources that
use Azure AD automatically get the benefits of guests and
you can seamlessly give guests access to your custom line
of business applications and third party applications.
In summary, B2B is an easier and better way to share
because you can use the same gesture to invite guests as to
share with an internal user in Microsoft applications. Guests
only have to manage one credential. You don’t need to
manage guest credentials, and you can manage guest
accounts like employee accounts with all the Azure AD
goodness available like conditional access and MFA.
Thank you for listening. And in the next video, I will show you
how B2B makes sharing seamless for any type of guest.
[MUSIC]