Logging into Microsoft 365 tenant as an external user

[garrytrinder]

A question was raised on Twitter by @alexandair asking whether it would be possible to log into a Microsoft 365 tenant using an external user account.

After some investigation, we have discovered that it is possible to do this.

To configure the CLI for this scenario, you are required to update the CLIMICROSOFT365_TENANTID environment variable to the tenant id of the target tenant before executing the m365 login command.

This does also require that the target tenant has consented to the use of the PnP Management Shell Azure AD application.

Is this scenario useful to you? We would love to hear your feedback.

[rroman81]

@garrytrinder I believe that this is a very valid scenario, indeed. I am actually trying to do that for testing a migration tool that does tenant 2 tenant. I want to use my corporate identity to create an external guest account in source/target AzureAd directories and assign roles then use the cli for management purposes. It would be great to avoid using extra admin accounts.

[garrytrinder]

Hey @rroman81 have you explored this further?

Is there anything that you could think of that we could do to make this easier?

[romanrozinov]

Hey @garrytrinder, pardon for the delay as work is extremely busy lately. I was trying to explore this using my corp identity and then creating an external account in my O365 dev tenant. When i set the CLIMICROSOFT365_TENANTID to my dev tenant, i found that devicelogin flow was redirecting me to "PnP Management Shell" enterprise app admin consent flow. I have already done that manually on my O365 Dev tenant, which is making me to believe that it's attempting to perform admin consent against my home organization. I'll need to review the auth flow for an external user a bit more carefully.

Further, the Office UI does not have a tenant context switch either, so this scenario would have to be purely cli based as i am not sure how navigate to O365 umbrella of sites as a AAD external user.