AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID B2B collaboration for external partners. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from devices that are compliant with Intune policies. Additionally, they need to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?
⚠ Common exam trap
Watch out — candidates often assume MFA and device compliance from external users are automatically trusted or can be enforced solely through Conditional Access, forgetting that cross-tenant trust settings must be explicitly configured to accept those claims from the external organization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure cross-tenant access settings to trust MFA and device compliance from external organizations, and then create a Conditional Access policy that requires MFA, compliant device, and a session sign-in frequency of 1 hour.
Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA and device compliance claims from external organizations, which is necessary when external users bring their own devices. Then, a Conditional Access policy targeting external users can enforce MFA, require compliant device, and set a session sign-in frequency of 1 hour using session controls. This combination ensures that the company's security requirements are met without relying on the external tenant's policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure cross-tenant access settings to trust MFA and device compliance from external organizations, and then create a Conditional Access policy that requires MFA, compliant device, and a session sign-in frequency of 1 hour.
Why this is correct
Cross-tenant access settings in Microsoft Entra ID let you explicitly trust MFA, compliant device, and hybrid Azure AD joined device claims that external organizations assert about their own users. After configuring that inbound trust for the partner tenant, you must create a Conditional Access policy that targets external users and grants access only when MFA is satisfied, a compliant device is reported, and the session sign-in frequency does not exceed one hour. This two-step approach is mandatory because the trust settings establish which claims are honored, while the Conditional Access policy defines the conditions and session controls that are actually enforced at the resource tenant.
- ✗
Create a Conditional Access policy for external users that requires MFA and compliant device, and set session controls for sign-in frequency. Trusting MFA from external tenants is automatic.
Why it's wrong here
This option incorrectly assumes that MFA and device compliance claims from an external tenant are trusted by the resource tenant by default. In reality, cross-tenant access settings must be explicitly configured to trust those inbound claims; otherwise, the resource tenant does not honor the home tenant's MFA or device compliance state. Simply creating a Conditional Access policy with MFA, compliant device, and sign-in frequency controls will not work if the device compliance claim is absent or untrusted, and it will likely force external users to re-register or re-authenticate rather than leveraging their home tenant's already completed MFA.
- ✗
Use Microsoft Entra ID Identity Protection to detect risky sessions for external users and require MFA only when risk is high. This will also enforce device compliance automatically.
Why it's wrong here
Microsoft Entra ID Identity Protection can evaluate risk for sign-ins, including those from external users, and a Conditional Access policy can use that risk as a condition to require MFA. However, Identity Protection does not enforce device compliance as a grant control; device compliance must be enforced separately through Conditional Access with the 'Require device to be marked as compliant' control, which in turn requires the device compliance claim to be trusted via cross-tenant access settings. The option also omits the required one-hour sign-in frequency session control, so it fails to fully satisfy the stated requirements.
- ✗
Configure Microsoft Entra ID Privileged Identity Management (PIM) for external users to activate MFA and require compliant device. PIM is for role activation, not for external user access policies.
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) is designed for just-in-time, time-bound activation of privileged roles like Global Administrator, not for enforcing authentication policies on external users. PIM's MFA requirement applies only during the role activation process, and it provides no mechanism to set a general session sign-in frequency or enforce device compliance for B2B collaboration users. Therefore, using PIM in this scenario would not deliver the required MFA, compliant device, or one-hour session controls for external access to the company's resources.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.