Exam SC-300 All Questions

View all questions & answers for the SC-300 exam

Exam SC-300 topic 1 question 14 discussion

Actual exam question from Microsoft's SC-300

Question #: 14
Topic #: 1

You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains an Azure AD enterprise application named App1.
A contractor uses the credentials of [email protected].
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [email protected].
What should you do?

A. Run the New-AzADUser cmdlet.
B. Configure the External collaboration settings.
C. Add a WS-Fed identity provider.
D. Create a guest user account in contoso.com.

Show Suggested Answer

Suggested Answer: D 🗳️

by AS007 at June 7, 2021, 12:03 p.m.

Comments

Submit Cancel

Jt909

Highly Voted 3 years, 11 months ago

Probably in the exam the cmdlet New-AzureADMSInvitation is proposed and correct

upvoted 25 times

...

AS007

Highly Voted 4 years, 2 months ago

Looks good given external collaboration is allowed/ default settings

upvoted 9 times

WMG

3 years, 4 months ago

Unless noted, all MS questions assume default settings.

upvoted 4 times

...

test123123

Most Recent 7 months, 1 week ago

Selected Answer: D

Invite user as guest, so a guest user :D

upvoted 1 times

...

Labelfree

9 months, 2 weeks ago

D is Correct. To provide the contractor with access to App1 using their credentials ([email protected]), you should use Azure AD B2B (Business-to-Business) collaboration. This allows external users to access your Azure AD resources using their own credentials. Steps to Provide Access Invite the Contractor as a Guest User: Go to the Azure AD admin center: https://aad.portal.azure.com. Navigate to Azure Active Directory > Users > New guest user. Enter the contractor’s email address ([email protected]) and send the invitation. Assign the Guest User to App1: After the contractor accepts the invitation, go to Azure Active Directory > Enterprise applications. Select App1 from the list of applications. Go to Users and groups and click on Add user/group. Search for the guest user ([email protected]) and assign them to App1. Configure Permissions: Ensure that the guest user has the necessary permissions to access App1. This might involve assigning specific roles or permissions within the application.

upvoted 3 times

Labelfree

9 months, 2 weeks ago

Replying to my own. Interesting - this was copilot's answer to the Q, surprised to see it still referencing Azure AD rather than Entra, but can't modify it now, but either way D should be the correct answer and the aad.portal.azure.com link redirects to Entra.

upvoted 2 times

...

bardock100

1 year, 3 months ago

Selected Answer: C

https://learn.microsoft.com/pl-pl/training/modules/implement-manage-external-identities/13-configure-identity-providers

upvoted 1 times

...

bardock100

1 year, 3 months ago

C) https://learn.microsoft.com/pl-pl/training/modules/implement-manage-external-identities/13-configure-identity-providers Here you have why C is the proper answer: End-user experience With SAML/WS-Fed IdP federation, guest users sign in to their Microsoft Entra tenant with their own organizational account. When they access shared resources and are prompted to sign in, users are redirected to their identity provider. Upon successful sign-in, users are returned to their Microsoft Entra ID to access resources. If a Microsoft Entra session expires or becomes invalid, and the federated identity provider has SSO enabled, the user uses SSO. If the federated user's session is valid, the user is not prompted to sign in again. Otherwise, the user will be redirected to their identity provider for sign-in. labedzkis

upvoted 1 times

Labelfree

9 months, 2 weeks ago

Using Microsoft Entra External ID (formerly Azure AD B2B) to invite the contractor as a guest user is generally a better solution than adding a WS-Fed identity provider for several reasons: Simplicity and Ease of Use Direct Invitation: Inviting the contractor as a guest user is straightforward and can be done directly through the Microsoft Entra admin center. This process is user-friendly and doesn’t require complex configurations. No Additional Setup: Adding a WS-Fed identity provider involves more steps, including configuring federation settings and ensuring compatibility with the external identity provider1.

upvoted 1 times

...

belyo

1 year, 5 months ago

Selected Answer: D

smtp suffix is outlook.com so its a MSFT account this is configured as one of the default identity providers and cannot delete it... so there is nothing you can configure in external collab, guess you have to invite user

upvoted 3 times

...

RahulX

1 year, 6 months ago

Microsoft Entra application access to external user: 1. Setup the External Collaboration setting. 2. Invite the user, once the user accept the invitation they will become a guest user of your tenant. 3. assign the user the app1.

upvoted 2 times

...

siffy

1 year, 6 months ago

shouldnt D say invite the user not create it?

upvoted 2 times

ak4exams

1 year, 5 months ago

That is what I feel.. it should be invite rather than create

upvoted 1 times

...

EmnCours

2 years ago

Selected Answer: D

Answer is correct.

upvoted 1 times

...

LOEG

2 years, 3 months ago

Hi Admin, why is the email not visible. The email is protected. how do are we able to answer questions when/ if the email in the question is protected

upvoted 1 times

...

kanew

2 years, 3 months ago

Selected Answer: B

B for me. D has to be incorrect as you can't create a Guest User with external Identity via AAD or PowerShell. You can invite one but not create one unless they have a tenancy (contoso.com etc) address. That rules out A and D. C is not correct as Outlook is a configured Identity provider by default so no action is required. With A you can use the external collaboration settings to enable Guest self-sign up via user flows and add the application to the self service flow. It's exactly what they need.

upvoted 1 times

kanew

2 years, 3 months ago

Sorry, that 2nd to last sentence should read... "With B you can use the external collaboration settings to enable Guest self-sign up via user flows and add the application to the self service flow."

upvoted 1 times

Holii

2 years, 2 months ago

1.) Configure External Collaboration Settings 2.) Create a User Flow That's 2 operations. Answer D can do this in 1 operation assuming default External Collaboration Settings.

upvoted 2 times

Holii

2 years, 2 months ago

I'd like to note that while this would be the (most ideal) solution when considering PoLP/Zero-Trust, it's too many steps in a process when you're just trying to add an account to access an app. That's the problem with these exams. It tests you getting the right answer, regardless if it's bad process for the long run.

upvoted 3 times

...

DorelPopKun

2 years, 3 months ago

Correct answer is D. New-AzADUser is used to create a new active directory user as work/school account

upvoted 1 times

...

Taigr

2 years, 6 months ago

Hi guys, so correct answer is D, not A? (This cmdlet is used to invite a new external user to your directory.)

upvoted 2 times

Holii

2 years, 2 months ago

New-AzureADUser is just a generic 'Add an Azure AD user' It can be used to create an Azure AD user inside your tenant. Funny thing is though, you can specify -UserType "Guest" and make an external guest account the same as D. I assume since it's not specifying the -UserType flag, it's not considering it. D is specifically talking about creating a guest account.

upvoted 2 times

...