When you're collaborating with other enterprises, it can be useful to aggregate all of their employees (your External Users) under the same Organizational Umbrella.
With External User Manager, you can add specific Organizations to your tenant and automatically add users (with the same domain) to them, allowing you to neatly organize Guests from the same Organization in a single, easily accessible place.
You can extract valuable information by creating an Onboarding Procedure specifically for Organizations, including Metafields, Onboarding Media, and Documents, as well as assigning responsible persons from the Organization who will fill those details.
Let's explore the setup and usage procedures associated with Organizations to understand how you can derive maximum value from this feature.
⚙️ Organization Setup
Start by navigating to Settings > Expert mode > Setup (under the Organizations header). You'll notice four distinct sections that can be activated.
Enable organization requests - This section enables the Organizations feature on your tenant; other sections won't be available unless it's active.
Approval for Organization - When enabled, ensures that new Organizations cannot be added to the tenant unless directly approved by an Admin/Approver.
Activate onboarding portal for approvals - Enables Onboarding features for Organizations and allows you to set up a distinct approval process for Responsible People to complete. Cannot be activated unless Onboarding is also active on the tenant.
Extended permissions for trusted organizations - If you have your Microsoft Entra Collaboration Settings set to "Allow invitations only to the specified domains", then activating this setting will automatically add all Organization domains to the Target domains list. Collaboration Settings can be found under the External Identities > Collaboration restrictions section of Microsoft Entra.
The Extended permissions for trusted organizations section will prompt you to grant additional permissions for the app. These permissions will ensure that EUM and Microsoft Entra can properly communicate and exchange the list of trusted domains.
🌐 Working with Organizations
For demonstrative purposes, we'll be describing a scenario in which all of the Organization functionality is enabled, which includes Approvals, Onboarding, and Extended Permissions.
If you haven't enabled one of these sections during setup, the corresponding actions will be skipped.
1. Creating Organizations
Organization Requests are tied to regular External User Requests. When you request a Guest with a specific domain, it can be added as a new Organization.
Let's take a quick look at the regular user's perspective.
Navigate to Requests > Add a request to get started.
Specify the desired Guest's Email.
You'll be moved to the Organizations tab. Click Add organization, and indicate a Responsible person (someone within the Organization who will be responsible for going through Onboarding Procedures and Signature Provision). The domain itself will be pulled directly from the Guest's Email; however, you can add other domains associated with this Organization if you want to.
Fill in any Metadata fields specified by the Admin; in our case, you need to provide a Project Length and an acknowledgment that the company has been vetted by management.
Choose the Teams that you want the Guest to have access to.
Leave a Comment if necessary and click on Create to finalize both the User invite and the new Organization.
2. Organization Approval & Onboarding
As an Admin (or an Org. Approver), you'll notice that you have a new Organization Request along with specific Requests for each Team that the External User is supposed to be added to.
Click the ✓ button next to the new Organization.
You'll be prompted to Approve the External User that the Organization is tied to.
Once the External User is approved, click the ✓ button again to approve the Organization itself.
The Organization Approval entry will be removed, and all the Team-specific Requests will change their status to Awaiting org signing.
Now that the Organization has been approved by the Admin, the Responsible person we've indicated earlier will receive an email with a link to the Onboarding Portal.
Once the Onboarding process has been completed by the Responsible person, you'll get the ability to Approve the Guest Invite for each individual Team.
3. Existing Organizations
You can add new domains to existing Organizations by selecting them in the Organization tab of the New Request pop-up.
Users who have been added this way won't require Approvals, since they're a part of a pre-approved Organization.
💡 Keep in mind that the list of organizations will display inactive organizations as well; adding a new domain to them will effectively reactivate them, with the new domain being the only one associated with them.
💼 Organization Management
Once your Organization has been created, you'll be able to oversee all aspects of it by navigating to the Overview > Organizations.
Here you'll be able to:
Quickly view all Members of a specific Organization, along with the number of Members, associated Teams, and Organization Status.
View and Edit the information specified by the Organization's Responsible Person through Metafields.
View the Organization's entire History, including Approvals, Onboarding Status, and the inclusion of Members in different Teams.
Perform the Bulk Deletion of users from the Organization.
Hide/Unhide deleted members of the organization.
Revoke Access for the entire Organization, removing all of its Members from all associated Teams and restricting their access to your tenant.
Download a detailed Audit Report relaying all of the abovementioned information.
View specific Members of the Organization in an expanded format, with the ability to take a more granular look at the specific Teams they're included in, Metadata information they've specified, and their entire Account History.
🔒 Microsoft Entra Connection
If the Extended permissions for trusted organizations setting section is enabled during setup and Microsoft Entra Collaboration restrictions are set to Allow invitations only to the specified domains, you'll see your Organizations show up in the corresponding list.
The list is updated in real-time, meaning any changes to the list will be immediately reflected on Microsoft's side.
⛑️ Need more help?
Get further assistance with Teams Manager through our support chat widget within the app, or reach out to us at [email protected]