AZ-900 Practice Question 71: B2B Guest Collaboration
Microsoft Azure Fundamentals (AZ-900) · Test 8 · question 1 of 10
A company needs to give an employee at a partner organization access to one internal SharePoint site for a joint project. The partner has its own Microsoft Entra tenant, and the company does not want to create and manage a separate password-protected account for that person. What should the company use?
Show answer and explanation
Answer:
Microsoft Entra B2B collaboration is built for exactly this scenario: "the partner uses their own identity management solution, so there's no external administrative overhead for your organization," and guest users "sign in to your apps and services with their own work, school, or social identities." A simple invitation-and-redemption process adds the partner's employee as a guest object in the company's directory without the company ever creating or managing a password for them.
Option B is wrong because MFA is an authentication *requirement* you can layer on top of any account, guest or not; it doesn't solve the underlying problem of how to grant access without creating a managed account in the first place. Option C is wrong because Key Vault stores secrets, keys, and certificates for applications; it isn't a mechanism for granting a person application access, and centrally storing another company's employee's credentials would defeat the purpose of letting them use their own identity. Option D is wrong because Conditional Access controls the *conditions* under which an already-established identity can sign in (like network location); it doesn't create the guest identity or grant access on its own.
Reference: What is Microsoft Entra B2B collaboration?