Exam MS-100 topic 3 question 79 discussion

Answer for the 1st question is User1 and User2. 2nd question is all users.

Q1- user 1 and 2 Q2 - user 1 create guest users is different from invite users

Just created a security administrator user. This is able to change the password protection policy within Azure AD. Security administrator cannot CREATE guest users, can only INVITE external users. - Have just tested this, so please test yourselves.

Anyone with an Azure tenant can tets this out themselves, I just did Azure->Users->"+ New User"-> you get 2 options 1)Create new user 2)Invite external user just below it, there is an option that says "Help me decide": Authorization for "Create a new user" = Global Admin and user Admin Authorization for "Invite a guest user" = controlled by your directory setting, (And points you to a path) Now the question states... Default config is applied. This question is referring to Inviting a guest user to your tenant as creating an account is assuming that the user is part of your organization and not a guest. "-Create a new guest user in Azure AD, similar to how you'd add a new user. -Assign guest users to apps or groups. -Send an invitation email that contains a redemption link, or send a direct link to an app you want to share." (And gives you a screenshot) Source: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b#easily-invite-guest-users-from-the-azure-portal

Guys please test these kind of things.. I just did, the answers are: User 1 & 2 Only User 1, User 2 & User 4

2nd https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal A role that allows you to create users in your tenant directory, such as the Global Administrator role or a limited administrator directory role (for example, Guest inviter or User administrator).

User1 only can modify the password protection policy. Check this url: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-administrator AND search "password protection policy".

B, B - Why user2 only for "create guest user accounts"? See Prerequisites in this article. https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal

When is "create" gueast is always mispelled, if you try to "Create" a guest user in AAD it brings you to INVITE it, the same if you perform the task on Powershell https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-invite-powershell The question is mispelled at the root, if default values are left in place every user is able to invite guest https://docs.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-guest-settings?view=o365-worldwide .. if only Microsoft could stops spraying in multiple places the same thing and collect them in one damn place

The answer is correct. It is currently appearing on AZ 104 as well.

About Question 1: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-administrator Security Admin can change policies Question 2 https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal Prerequisites A role that allows you to create users in your tenant directory, like the Global Administrator role or any of the limited administrator directory roles such as guest inviter or user administrator.

So, I had to look at this in my tenant. Q1: Modify the password protection policy: User1 and User2 only. Global admins and Security Admins can change the password policy. As well as user administrators, but none of these users are user admins, aside from the GA. Q2: Create new guest users in Microsoft Azure Active Directory (Azure AD): User1/2/3/4. External collaboration settings have the default settings. That means all users are allowed to invite guests to the domain. When you invite a guest, it creates a guest account. So they are one-in-the-same. User2 has the Guest Inviter role assigned, which is not needed due to the default collaboration settings. The only time you need to use the Guest Inviter role is when you have restricted who can invite others.

A role that allows you to create users in your tenant, like Global Administrator role or any of the limited administrator directory roles such as guest inviter or user administrator will allow you to create Guest Account

It is: Modify password policy - Global Admin, Security Admin. Create (Invite!) users in Azure AD - Global Admin, Security Admin, Password Admin. User with no admin role assigned will be denied access to Azure AD blade.

External collaboration settings have a default configuration, everyone can invite guest users. User 1, User 2 can modify ,creat PPP

answer for 2nd question : user1 and user2 only https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal

Security admin can modify password protection. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-administrator