The tenant admin configures that mapping. They can also configure whether the data can be exposed to users outside of the organization. There’s no magic here.