AZ-104 Practice Question 21: Entra B2B Guest Access
Microsoft Azure Administrator Associate (AZ-104) · Test 3 · question 1 of 10
Three external auditors from a partner firm need read-only access to one Azure subscription for a three-month engagement. Their firm has its own Microsoft Entra tenant.
Contoso's security team insists that the auditors sign in with their existing corporate credentials, that Contoso never issues or resets a password for them, and that the access can be withdrawn in a single step when the engagement ends.
What should you do?
Show answer and explanation
Answer:
B2B collaboration exists for exactly this case. "A simple invitation and redemption process lets partners use their own credentials to access your company's resources," and once redeemed the partner "is represented in your directory as a user object" with the user type set to *guest*. Because the partner keeps using their own identity management solution, "you don't need to manage external accounts or passwords" and "you don't need to sync accounts or manage account lifecycles." The guest object is a normal Entra principal, so a Reader assignment on the subscription works like any other, and deleting the guest removes the access in one step.
Option A creates the very thing the security team ruled out: Contoso-owned credentials for people outside Contoso, with Contoso responsible for password resets, lifecycle, and offboarding.
Option B swaps a person for a shared secret. A service principal has no individual sign-in, so no per-auditor conditional access or MFA applies and the audit trail shows one identity for three people. Secrets also leak and are rarely rotated after an engagement ends.
Option C is not a capability Azure has. Management groups organise subscriptions within a *single* Entra tenant; they do not federate or nest other tenants, and they do not grant sign-in rights to another organisation's accounts.
Reference: What is Microsoft Entra B2B collaboration?