SC-300 External Identities and B2B Collaboration 1 — Questions and Answers
Question 1: Which Azure AD feature allows an organization to invite users from external organizations to collaborate on internal resources without requiring them to have an Azure AD account?
- Azure AD B2C
- Azure AD B2B collaboration (Correct answer)
- Azure AD External Identities cross-tenant sync
- Azure AD Connect
Correct answer: Azure AD B2B collaboration
Azure AD B2B collaboration allows external users to sign in using their own credentials (social or corporate identity) and be granted access to the inviting organization's resources as guest users.
Question 2: When an external user accepts a B2B collaboration invitation, what type of account is created in the inviting organization's Azure AD tenant?
- A new member user account
- A guest user account (UserType = Guest) (Correct answer)
- A service principal
- A managed identity
Correct answer: A guest user account (UserType = Guest)
B2B invited users are represented in the inviting tenant as guest accounts with UserType set to 'Guest,' which limits their default permissions compared to member accounts.
Question 3: Which Azure AD setting controls which external domains are allowed or blocked from receiving B2B collaboration invitations?
- Conditional Access external collaboration policy
- External collaboration settings: Allow/deny list for domains (Correct answer)
- Cross-tenant access settings inbound configuration
- Identity Protection sign-in risk policy
Correct answer: External collaboration settings: Allow/deny list for domains
The external collaboration settings in Azure AD include an allow/deny list where administrators can specify which external domains are permitted or blocked from B2B collaboration.
Question 4: A guest user in an Azure AD tenant tries to enumerate all users in the directory and receives a permission error. Why does this occur?
- Guest users are blocked by Conditional Access by default
- Guest users have restricted default permissions that prevent directory enumeration (Correct answer)
- The guest user's account has not been verified via MFA
- Guest user accounts are only visible in the inviting tenant for 30 days
Correct answer: Guest users have restricted default permissions that prevent directory enumeration
By default, Azure AD guest accounts have limited directory permissions and cannot enumerate other users or groups, unlike member accounts which have broader read access.
Question 5: Which Azure AD External Identities feature allows a completely separate consumer-facing identity store with custom sign-up and sign-in flows using social identities like Google and Facebook?
- Azure AD B2B collaboration
- Azure AD B2C (Correct answer)
- Cross-tenant access settings
- External Identities self-service sign-up
Correct answer: Azure AD B2C
Azure AD B2C is a separate identity platform designed for consumer-facing applications that supports custom sign-up and sign-in experiences with social identity providers and local accounts.
Question 6: Which Azure AD External Identities setting controls whether guest users can invite other external users into the tenant?
- Guest invite restrictions in External collaboration settings (Correct answer)
- Conditional Access guest user policy
- B2B collaboration allow list
- Cross-tenant access inbound settings
Correct answer: Guest invite restrictions in External collaboration settings
The 'Guest invite restrictions' in External collaboration settings determines whether guest users can send B2B invitations, limiting this capability to admins only or allowing guests to invite others.
SC-300 External Identities and B2B Collaboration 1
Which Azure AD feature allows an organization to invite users from external organizations to collaborate on internal resources without requiring them to have an Azure AD account?