An enterprise organization is collaborating with external partner companies on projects hosted in Azure. The security team needs to satisfy the following requirements: Allow external partners to sign in using their existing organizational identities without creating local accounts in the host tenant Automatically ensure that when an external partner employee leaves their company, their access to the host organization's resources is revoked immediately Enforce multifactor authentication (MFA) via automated policies based on sign-in conditions when partners access corporate resources Which identity solution should the organization implement?

Microsoft Entra B2B collaboration with Conditional Access policies: ### What Microsoft Entra B2B Collaboration with Conditional Access Is **Microsoft Entra B2B collaboration** (Business-to-Business) is an **External Identities** feature that enables organizations to securely share applications and cloud resources with guest users from external organizations. Partner users authenticate against their own **home identity provider (IdP)**, while the resource tenant retains full governance and authorization control over the resources they can access. When combined with **Microsoft Entra Conditional Access**, administrators can enforce granular, automated security controls—such as requiring **multifactor authentication (MFA)**—specifically for guest and external users. ### How It Meets the Requirements - **External identity authentication**: External partner users sign in using their existing work or school accounts from their home identity providers, eliminating the need to manage duplicate local credentials. - **Automatic lifecycle management**: If a partner employee leaves their employer and their account is disabled or deleted in their home organization, they instantly lose the ability to authenticate to the host organization's resources. - **Automated security enforcement**: **Conditional Access policies** evaluate real-time signals (such as user risk, sign-in location, and target application) and enforce **multifactor authentication (MFA)** dynamically without requiring constant manual intervention. ### Key Advantages and Capabilities - **Reduced administrative overhead**: IT teams do not need to issue passwords, perform password resets, or manage identity lifecycles for external guests. - **Enhanced security posture**: Prevents orphaned accounts by tying external access directly to the partner's authoritative directory status. - **Policy enforcement in resource tenant**: The host organization defines and enforces its own **Conditional Access** and access control rules regardless of the partner's baseline settings. - **Seamless user experience**: Partner users utilize single sign-on (SSO) with credentials they already know and manage. - **Auditing and monitoring**: All external sign-ins and resource access events are recorded in the host tenant's **audit logs** and sign-in reports for compliance. ### Why This Is Optimal Using **Microsoft Entra B2B collaboration** with **Conditional Access** is the recommended best practice for business partner collaboration. Unlike creating local directory accounts or using consumer-focused authentication services, B2B collaboration maintains strict tenant security boundaries while delegating credential lifecycle management to the partner's identity provider.