Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Requiring MFA for B2B Guest Users
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is collaborating with an external vendor consultant on a cloud project. An administrator needs to configure access to company resources while satisfying the following security and operational requirements:
- The consultant must be able to sign in using their existing external corporate email account.
- The consultant must be required to complete multifactor authentication (MFA) when accessing corporate applications to maintain organizational compliance.
- The administrator must manage access permissions directly from the directory without creating and maintaining a separate internal password for the consultant.
Which solution should the administrator implement?
Explanations
Invite the consultant as a B2B guest user in Microsoft Entra ID and assign a Conditional Access policy requiring multifactor authentication.
Invite the consultant as a B2B guest user in Microsoft Entra ID and assign a Conditional Access policy requiring multifactor authentication.
What B2B External Identities and Conditional Access Are
Microsoft Entra External ID (B2B collaboration) is a capability that allows organizations to securely share applications and resources with external users, such as vendors, partners, and contractors. Conditional Access is an identity-driven policy engine that evaluates real-time signals—such as user location, group membership, and risk level—to enforce access controls like multifactor authentication (MFA) or session restrictions.
How It Meets the Requirements
- External Account Sign-In: When an administrator invites an external user via B2B collaboration, the guest signs in using their existing external work identity, school account, or social identity without needing a separate local credential.
- Enforced MFA Compliance: A Conditional Access policy can be specifically scoped to Guest or external users, requiring them to complete an MFA challenge when accessing targeted cloud applications.
- Simplified Administration: Permissions and role-based access control (RBAC) are assigned directly to the guest object in the resource tenant while identity lifecycle and password management remain with the user's home identity provider.
Key Advantages and Capabilities
- Seamless Onboarding: Administrators can invite guests directly through the admin center using an email address and personalized message.
- Predictable Resource Protection: The resource tenant enforces its own security standards, ensuring organizational compliance regardless of external partner setup.
- Granular Access Control: Permissions can be assigned to directory roles, security groups, or individual Azure resources.
- Policy Simulation: Administrators can utilize the What If tool to test and validate Conditional Access behavior prior to active enforcement.
Why This Is Optimal
This approach eliminates administrative overhead by avoiding duplicate credentials while ensuring strict compliance with corporate security standards through automated Conditional Access enforcement.
Create a user-assigned managed identity and assign the Managed Identity Contributor role to the consultant.
Create a user-assigned managed identity and assign the Managed Identity Contributor role to the consultant.
What User-Assigned Managed Identities Are
A user-assigned managed identity is an Azure resource that provides an automatically managed identity in Microsoft Entra ID for cloud applications, services, and workloads to authenticate against Azure services supporting Entra authentication.
Why It Does Not Meet the Requirement
- Not for Human Users: Managed identities are strictly designed for software workloads, virtual machines, and automated applications, not human users or external consultants.
- No Interactive Sign-In: Managed identities do not have interactive credentials, email inboxes, or multifactor authentication registration workflows for humans.
- Incorrect Role Scope: Assigning the Managed Identity Contributor role grants administrative privileges to create and manage identity objects rather than granting the user access to business applications.
Key Characteristics and Limitations
- Credential Elimination in Code: Managed identities eliminate hard-coded connection secrets and passwords inside source code.
- Shared Resource Lifecycle: A user-assigned managed identity can be assigned to multiple Azure resources (such as VMs or App Services) independently of the resource lifecycle.
- No User Profiles: They cannot store personal user attributes, external email domains, or user-specific group memberships.
This Answer Would Be Correct If
This option would be correct if an automated background service hosted on an Azure Virtual Machine needed to securely access an Azure Key Vault without storing secrets in configuration files.
Deploy an Azure AD B2C tenant with a custom user flow configured to generate local accounts with username and password sign-in.
Deploy an Azure AD B2C tenant with a custom user flow configured to generate local accounts with username and password sign-in.
What Azure AD B2C Local Account Flows Are
Azure AD B2C is a customer identity and access management (CIAM) solution designed to support millions of external consumers accessing customer-facing web and mobile applications through user flows or custom policies.
Why It Does Not Meet the Requirement
- Wrong Solution Scope: B2C is intended for consumer-facing applications (business-to-customer), whereas vendor collaboration requires B2B external identities.
- Creates Redundant Credentials: A local account user flow forces the external user to register a brand new local username and password in the B2C directory.
- Cannot Access Internal Azure Management Resources: Consumer accounts created within an Azure AD B2C directory cannot access Azure administrative resources, such as the Azure portal or internal enterprise tools.
Key Characteristics and Limitations
- Consumer Account Isolation: Consumer accounts in B2C are isolated and cannot be assigned standard directory roles to manage Azure resources.
- Branded Self-Service Journeys: Provides highly customizable sign-up and sign-in experiences for retail and commercial consumers.
- Mass Scale: Designed to accommodate millions of external customer identities rather than business partner access.
This Answer Would Be Correct If
This option would be correct if the organization were building a public e-commerce website and needed millions of end consumers to register new shopping accounts with custom local passwords.
Configure Microsoft Entra Connect with password hash synchronization to replicate the external vendor's on-premises Active Directory.
Configure Microsoft Entra Connect with password hash synchronization to replicate the external vendor's on-premises Active Directory.
What Microsoft Entra Connect and Password Hash Sync Are
Microsoft Entra Connect is an on-premises synchronization tool used in hybrid identity environments to synchronize user accounts, security groups, and password hashes from an organization's on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID.
Why It Does Not Meet the Requirement
- Inappropriate for External Collaboration: Microsoft Entra Connect is meant for synchronizing an organization's own internal directory, not establishing external partner connections.
- Administrative Boundary Violation: Installing synchronization agents into an external vendor's directory is a major security and management violation.
- Doesn't Manage Guest Access: Synchronized accounts are treated as native internal directory members rather than distinct B2B external identities.
Key Characteristics and Limitations
- Hybrid Identity Sync: Replicates on-premises user credentials and directory objects into the cloud tenant.
- Domain Controller Dependency: Requires direct network connectivity and high-privilege service accounts in local AD DS forests.
- No Direct Guest Onboarding: Cannot dynamically invite third-party partner email domains via email invitations.
This Answer Would Be Correct If
This option would be correct if the organization needed its own internal on-premises employees to use their existing corporate passwords when signing in to Microsoft 365 or Azure resources.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure AD B2C CIAM
Describe external identities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra B2B Collaboration with Conditional Access
Describe external identities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra B2B Collaboration
Describe external identities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra External ID User Flows
Describe external identities in Azure
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud CSPM
Describe the purpose of Microsoft Defender for Cloud
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated