Task 1.3: Implement and manage identities for external users and tenants

• ACollaboration restrictions in external collaboration settings that allow invitations only to fabrikam.com

  Incorrect

  A domain allow list limits invitations by domain; it can't limit access to one group inside Fabrikam.

• BInbound B2B collaboration in the default cross-tenant access settings, set to allow only the Project-Atlas group's object ID

  Incorrect

  Inbound default settings can't target users or groups; only organizational settings can.

• CTenant restrictions v2 that allow only Fabrikam's Project-Atlas group

  Incorrect

  Tenant restrictions control which external tenants your own users can reach, not who enters your tenant.

• DBlock inbound B2B collaboration by default, then add Fabrikam with inbound access allowed only for Project-Atlas's object ID

  Correct

  Organizational inbound settings override the defaults and can target the partner's users and groups by object ID.

Cross-tenant access default settings apply to every external Microsoft Entra organization without its own settings. Blocking inbound B2B collaboration there (users and applications) and adding Fabrikam as an organization whose inbound settings allow only the Project-Atlas group, by object ID, meets both conditions. Targeting specific external users and groups needs Microsoft Entra ID P1 or P2 and isn't possible in the defaults.

• AIn Fabrikam's inbound cross-tenant settings for Contoso, select Allow user synchronization into this tenant

  Correct

  The target tenant must allow inbound synchronization from the source before the sync job can create users there.

• BIn Contoso's inbound cross-tenant settings for Fabrikam, select Allow user synchronization into this tenant

  Incorrect

  The sync setting belongs to the target tenant, where users are created, not to the source.

• CIn Fabrikam's external collaboration settings, let anyone in the organization invite guests

  Incorrect

  Guest invite settings govern invitations; cross-tenant synchronization doesn't send invitations.

• DSelect automatic redemption in Contoso's outbound settings for Fabrikam and in Fabrikam's inbound settings for Contoso

  Correct

  The consent prompt and invitation email are suppressed only when both tenants select automatic redemption.

• EIn Fabrikam's inbound settings for Contoso, allow B2B direct connect for all users

  Incorrect

  B2B direct connect serves Teams shared channels and creates no user objects.

In the target tenant, inbound cross-tenant settings for the source enable cross-tenant synchronization. The automatic redemption setting suppresses the first-time consent prompt and invitation email only when it's selected for both the source (outbound) and the target (inbound).

• AContoso adds fabrikam.com as a custom domain in its own tenant and verifies it with a DNS record

  Incorrect

  Federation doesn't need the partner's domain verified in your tenant, and you can't verify a domain you don't own.

• BFabrikam publishes a TXT record in the fabrikam.com DNS zone for its identity provider's URL

  Correct

  When the endpoint's domain doesn't match the federated domain, the partner publishes a TXT record for it.

• CContoso adds Google as an identity provider and moves it to the top of the redemption order for Fabrikam

  Incorrect

  Google federation serves Gmail accounts, not a partner's own SAML identity provider.

• DContoso moves email one-time passcode to the top of the redemption order

  Incorrect

  Email one-time passcode bypasses the partner's identity provider instead of federating with it.

Microsoft Entra ID checks that the partner's passive authentication URL belongs to the domain being federated. If it doesn't (here fabrikamgroup.net for fabrikam.com), the partner adds a TXT record to its DNS that names the authentication URL. The federated domain doesn't have to be verified in your tenant.

• AChange her userType from Guest to Member

  Incorrect

  userType sets her default permissions; she would still authenticate with her Fabrikam account.

• BUse Convert to internal user, providing a contoso.com user principal name and a password

  Correct

  Conversion keeps the user object and its access, and she then authenticates with the local tenant.

• CReset her redemption status and send a new invitation to her contoso.com address

  Incorrect

  Resetting redemption keeps her an external user who signs in through another identity provider.

• DDelete the guest account, then create a new member account with a contoso.com user name and password

  Incorrect

  A new account has a new object ID and loses her memberships and assignments.

External user conversion turns an external user into an internal one without deleting the object, so memberships, assignments and activity history stay. For a cloud-only user, the admin supplies a UPN in a non-federated domain and a password. Changing userType alone doesn't change where the user authenticates.

• AWith a Google account, which every guest must create

  Incorrect

  Google federation applies only to Gmail accounts and only if set up.

• BWith a one-time passcode sent to the guest's email address

  Correct

  Email one-time passcode is the fallback when no other method applies, and it's on by default.

• CWith a temporary password that a Contoso admin sets for each guest

  Incorrect

  Guests authenticate with their own identity, not a Contoso-set password.

• DWith a Temporary Access Pass created by the inviter

  Incorrect

  Temporary Access Pass serves internal users registering methods.

Email one-time passcode authenticates B2B guests who can't use Microsoft Entra ID, a Microsoft account or a social or federated identity provider. It's turned on by default and acts as the fallback method.

• AThey have the same access as members

  Incorrect

  That's the most inclusive option, not the default.

• BThey can see only their own profile, with no other users or groups

  Incorrect

  That's the most restrictive option, not the default.

• CThey have limited access to properties and memberships of directory objects

  Correct

  The default blocks tasks such as enumerating users and groups.

• DThey can't sign in at all until an admin sets a directory access level for them

  Incorrect

  Guests can sign in once they redeem an invitation.

The default guest user access setting is Guest users have limited access to properties and memberships of directory objects, which blocks tasks such as enumerating users, groups and other directory resources. The other options give guests the same access as members or only their own profile.

• AContoso's internal members and the guests Contoso has invited

  Incorrect

  External users of the source tenant can't be synchronized.

• BOnly users synced to Contoso from on-premises Active Directory

  Incorrect

  Cloud-only and synced internal members can both be in scope.

• CContoso's internal members only

  Correct

  Cross-tenant sync pushes internal members from the source; it doesn't sync the source's external users.

• DOnly users who hold a Microsoft Entra ID P2 license

  Incorrect

  Scope is set by assignment, not by each user's license.

Cross-tenant synchronization supports pushing only internal members from the source tenant; it doesn't support syncing external users (guests) from the source. Which internal members are in scope is set by assigning users and groups to the configuration in the source tenant.

• AIt lets Microsoft Entra ID renew the expiring signing certificate automatically

  Correct

  Without a metadata URL, an expired or rotated certificate must be updated by hand.

• BIt verifies the partner's domain in your tenant

  Incorrect

  Federation doesn't verify the partner's domain in your tenant.

• CIt sets the redemption order for the partner's users

  Incorrect

  Redemption order is set in cross-tenant access settings.

• DIt's the only way to enter the partner's passive authentication endpoint and issuer

  Incorrect

  The endpoint can also be entered manually or from a metadata file.

The metadata URL is optional but strongly recommended: Microsoft Entra ID uses it to renew the partner's signing certificate automatically when it expires. Without it, or if the certificate is rotated early, you update the certificate manually.