According to the Microsoft Entra External Identities module within the SC-300 curriculum, control over which external domains can be invited as guest users is managed under External collaboration settings in the Entra admin center.
Administrators can specify "Allow invitations only to the specified domains" and list approved domains.
This ensures that guest invitations can only be sent to trusted business partners while blocking all others.
Cross-tenant access settings control authentication and access policies between trusted tenants, not invitation restrictions. Linked subscriptions and identity providers manage billing and authentication federation but do not control guest invitations.
Therefore, to restrict guest invitations to specific external domains, you must configure the External collaboration settings in Microsoft Entra ID.