Why shared channels exist
Guest access makes outsiders switch tenants (the dreaded org-switcher) and creates directory objects to manage. Shared channels invert it: the CHANNEL is shared outward, and external people work from their own tenant, their own client session, appearing in your channel natively. No #EXT# object in your directory for them.
The trust fabric: B2B direct connect
Underneath is cross-tenant access settings (Entra), a mutual contract:
- YOUR outbound settings must allow your users to participate in the partner's shared channels; THEIR inbound must accept you — and vice versa for hosting.
- Trust settings decide whether you accept the partner tenant's MFA/compliant-device claims instead of forcing your own — the grown-up version of guest CA.
- Default is OFF: every partner is an explicit, auditable enablement. There is no "open federation" mode for shared channels — by design.
Objects: a shared channel has its own membership (users, whole teams — including from other tenants) and its own SharePoint site, so file access precisely equals channel membership.
Sharp edges
| Edge | Reality |
|---|---|
| Compliance boundary | External members' messages are recorded in the HOST tenant (it's your channel); their tenant records nothing here — mirror-image of federation |
| eDiscovery | Host discovers everything in the channel, incl. external members' posts; partners discover nothing |
| No guest-policy inheritance | Guest settings/labels' guest rules do NOT govern shared channels — separate switch set (-AllowSharedChannel* in TeamsChannelsPolicy, cross-tenant settings). Auditors conflate them; you shouldn't |
| Meetings | Channel meetings in shared channels have historically lagged in capability — verify current state before promising parity |
| Membership sprawl | Sharing a channel WITH A TEAM brings that team's whole membership transitively — review who that actually is |
What to watch (proofs)
- Policy state:
Get-CsTeamsChannelsPolicy | fl *Shared*— who may create/share/join shared channels (scanned nightly by serv365; drift posts to your channel). - The trust contract: Entra > External identities > Cross-tenant access settings — per-partner inbound/outbound B2B direct connect + trust toggles; export this list, it IS your shared-channel partner registry.
- Real usage:
Get-TeamChannel -MembershipType Sharedper team for inventory; GraphsharedWithTeamsfor where each is shared. - The no-directory-object claim: search Entra for the external member after they post — absence of a guest object while the message exists in eDiscovery is the architecture, proven.