AZ-305 Practice Question 51: Customer Identity Signup
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 6 · question 1 of 10
A retailer is building a mobile shopping app for an expected 2 million consumers. Customers must be able to sign up themselves with an email address or a social account, reset their own passwords, and see the retailer's branding on every sign-in page. The security team requires that customer accounts stay completely separate from the workforce directory used by employees, and consumers never need access to internal resources.
What should you include in the design?
Show answer and explanation
Answer:
Microsoft Entra External ID supports customer-facing apps through an external tenant, a directory that is separate from the workforce tenant. In it you configure self-service sign-up user flows, social identity providers, self-service password reset and company branding for the consumer experience, which is exactly the list of requirements in the scenario.
Option A uses the wrong model. Business-to-business guests are partners and collaborators who are invited into the workforce tenant to reach internal resources, so 2 million consumers would end up inside the employee directory, which the security team ruled out.
Option C has the same problem and adds more: consumers would be full members of the workforce directory, and it is not designed for self-service consumer sign-up at this scale.
Option D is unrelated to modern app sign-in. Domain Services provides legacy domain join, LDAP and Kerberos for lift-and-shift workloads; it offers no consumer sign-up flows and would not serve a mobile app.
Reference: Microsoft Entra External ID overview