Question
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains an Azure AD enterprise application named App1.
A contractor uses the credentials of user1@fabrikam.com.
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as user1@fabrikam.com.
What should you do?
- A. Run the New-AzADUser cmdlet.
- B. Configure the External collaboration settings.
- C. Add a WS-Fed identity provider.
- D. Create a guest user account in contoso.com. Correct
Explanation
Inviting the contractor as a B2B guest user in contoso.com creates a guest object that authenticates with the contractor's existing external identity, and you can then assign that guest to App1. New-AzADUser creates a new member account with contoso.com credentials, which does not let the contractor sign in with their own account. External collaboration settings only control who may invite and which domains are allowed, and a WS-Fed identity provider is only needed when the partner's own federation service must be trusted; neither grants access by itself.
