SC-300 External Identities and B2B Collaboration 2 — Questions and Answers
Question 1: What is the purpose of Cross-Tenant Access Settings in Azure AD External Identities?
- To synchronize user accounts between tenants automatically
- To control inbound and outbound B2B collaboration and trust settings with specific partner tenants (Correct answer)
- To configure SAML federation with external identity providers
- To manage Azure subscription access across tenants
Correct answer: To control inbound and outbound B2B collaboration and trust settings with specific partner tenants
Cross-Tenant Access Settings allow organizations to configure per-tenant trust policies for inbound and outbound B2B collaboration, controlling who can be invited and what MFA claims are trusted.
Question 2: An organization wants to trust the MFA claims from a partner tenant so that partner users are not re-challenged for MFA when accessing the organization's resources. Where is this configured?
- Conditional Access named locations
- Cross-Tenant Access Settings > Inbound trust settings > Trust MFA from Azure AD tenants (Correct answer)
- Azure AD Identity Protection sign-in risk policy
- External collaboration settings
Correct answer: Cross-Tenant Access Settings > Inbound trust settings > Trust MFA from Azure AD tenants
Inbound trust settings in Cross-Tenant Access Settings allow administrators to trust MFA claims from a specific partner tenant, preventing redundant MFA challenges for already-authenticated partner users.
Question 3: What happens when an administrator enables the 'Self-service sign-up' user flow for an application in Azure AD External Identities?
- Existing member users can modify their own profiles
- External users can create a guest account by signing up through the application without an invitation (Correct answer)
- All users are required to verify their identity via government ID
- Guest users are automatically promoted to member accounts
Correct answer: External users can create a guest account by signing up through the application without an invitation
Self-service sign-up user flows allow external users to discover and register for access to an application independently, creating a guest account through a guided sign-up experience.
Question 4: Which identity provider can be configured in Azure AD External Identities to allow external users to sign in using their Google accounts?
- SAML/WS-Fed federation
- Google federation (direct federation) (Correct answer)
- LinkedIn social identity provider
- One-time passcode (OTP)
Correct answer: Google federation (direct federation)
Azure AD External Identities supports Google federation as a social identity provider, allowing users with Google accounts to sign into the tenant's applications as B2B guests.
Question 5: What is the purpose of the 'Email one-time passcode' feature in Azure AD External Identities?
- It sends a permanent password to new guest users
- It provides a fallback authentication method for external users who cannot use other identity providers (Correct answer)
- It replaces Azure MFA for all external users
- It generates app passwords for legacy protocols
Correct answer: It provides a fallback authentication method for external users who cannot use other identity providers
Email one-time passcode provides a fallback mechanism for B2B guest users who don't have an Azure AD account, Microsoft account, or supported social identity, sending a temporary code to their email for authentication.
Question 6: An administrator needs to restrict external B2B guest users from having access to the Azure AD administrative portals. Which approach accomplishes this?
- Remove all Azure AD licenses from guest accounts
- Configure a Conditional Access policy that blocks guest users from accessing the Azure portal and admin center (Correct answer)
- Set the guest user default permissions to restrict all access
- Delete all guest user accounts and re-invite with limited roles
Correct answer: Configure a Conditional Access policy that blocks guest users from accessing the Azure portal and admin center
A Conditional Access policy scoped to guest user accounts and targeting the Microsoft Azure Management cloud app can block external users from accessing administrative portal interfaces.
SC-300 External Identities and B2B Collaboration 2
What is the purpose of Cross-Tenant Access Settings in Azure AD External Identities?