Exam MS-100 topic 3 question 65 discussion

It is possible to create a guest user without a User Administrator. Therefore, guest creation is possible for all users.

1,2,3 & 4, https://docs.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-guest-settings?view=o365-worldwide default settings

I'm not sure how noone has referenced this: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal#add-a-new-guest-user-in-azure-ad Add a new guest user in Azure AD: Sign in to the Azure portal with an account that's been assigned the Global administrator, Guest, inviter, or User administrator role.

The answers are correct. Any admin can invite a gues but only the Global Admin, Guest inviter or User administrator can create a guest. https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal

Correct answers given.

I have tested to create a guest user from Azure AD portal with a user with "sec admin" role, I found create user is grayed out and only invite user is there. The provided answer is correct, only "user admin" can create guest users. Referecne: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal#:~:text=A%20role%20that%20allows%20you%20to%20create%20users%20in%20your%20tenant%20directory%2C%20like%20the%20Global%20Administrator%20role%20or%20any%20of%20the%20limited%20administrator%20directory%20roles%20such%20as%20guest%20inviter%20or%20user%20administrator

"External collaboration settings have default configuration." Anyone in the organization can invite guest users including guests and non-admins (most inclusive) I've tried logging in to portal.azure.com as a regular (non-admin) account, I was able to create a guest user (invite). Users 1,2,3 & 4 can create Guest Users and only User 2 can add User 3 to Admin1.

To cut a long story short for all the guessing and discussion about the Guest User Accounts: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal => Prerequisites A role that allows you to create users in your tenant directory, like the Global Administrator role or any of the limited administrator directory roles such as guest inviter or user administrator.

External collaboration settings have default configuration. Anyone can invite guest https://docs.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-guest-settings?view=o365-worldwide

External Collaboration setting is set to default : Guest invite settings Anyone in the organization can invite guest users including guests and non-admins Enable guest self-service sign up via user flows No Collaboration restrictions Allow invitations to be sent to any domain 1- All the users 2-User 2

the answer is correct. both User 2 only. https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal Prerequisites: To complete the scenario in this tutorial, you need: A role that allows you to "create" users in your tenant directory, like the "Global Administrator" role or any of the limited administrator directory roles such as "guest inviter" or "user administrator". A valid email account that you can add to your tenant directory, and that you can use to receive the test invitation email.

https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal

many people says that invite is not the same that create where is the reference ? by default all users can "invite".

if any user in tenant invites guest user - guest user is created this is default External collaboration setting! - and it's pointed out in question. "By default, all users and guests in your directory can invite guests even if they're not assigned to an admin role." reference: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/delegate-invitations

If you "invite" a guest user, don't you have to create the guest user account first? So doesn't that mean "inviting" a guest user is creating a guest user?

i would go with user administrator (because I think invite is nit the same as create) and I would go with all 4 ( because I have tested it and any of mentione roles grants access for group management)

If they mean "invite" same as create guest user then anyone in the organization can create guest account. https://docs.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-guest-settings?view=o365-worldwide