AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-tenant synchronization

  Why it's wrong here

  Cross-tenant synchronization is a provisioning capability in Microsoft Entra ID that creates and updates B2B user objects across tenants, often used in multi-tenant organizations to share access to applications. However, it does not perform authentication; an external user still needs to authenticate against their home tenant via a B2B collaboration flow or another federation method. Therefore, choosing this alone would not enable partner users to sign in using their own identity provider.

• ✗

  Conditional Access policy for guest users

  Why it's wrong here

  Conditional Access policies are access-control rules that evaluate signals such as user risk, device compliance, and location to allow or block access to resources. They can be targeted at guest users to enforce multi-factor authentication or restrict access, but they do not provide an authentication mechanism for external users. Without first enabling external identities like B2B collaboration, no guest accounts exist to evaluate, so this option cannot fulfill the requirement for partner authentication.

• ✓

  Microsoft Entra B2B collaboration with external identities

  Why this is correct

  Microsoft Entra B2B collaboration is the external-identities feature that lets you invite external users to access resources while they authenticate with their own identity provider, such as a corporate Microsoft Entra ID tenant, Microsoft account, or a social IdP. This creates a guest user object in your tenant but the actual sign-in occurs at the partner's home tenant, and your tenant accepts the resulting token. This satisfies the requirement of allowing partner users to use their own credentials without managing passwords for them.

• ✗

  Microsoft Entra guest user accounts with password

  Why it's wrong here

  Creating guest user accounts with a password in your Entra ID tenant means you are provisioning local credentials for each partner user, effectively managing their authentication yourself. This does not leverage the partner's own identity provider, so you would be responsible for password resets, expiration, and compliance policies for those accounts. In contrast, B2B collaboration delegates authentication to the partner's federated identity provider, which is the intended way to support external identities.

Go deeper

Related to this question