Three external auditors from a partner firm need read-only access to one Azure subscription for a three-month engagement. Their firm has its own Microsoft Entra tenant.
Contoso's security team insists that the auditors sign in with their existing corporate credentials, that Contoso never issues or resets a password for them, and that the access can be withdrawn in a single step when the engagement ends.