AZ-500 Manage identity and access Practice Question
A company uses Azure AD B2B collaboration to invite external partner users to collaborate on a project. The security team wants to ensure that when a partner user's account is disabled in their home Azure AD tenant, the user should immediately lose access to the company's resources, even if the user had a valid session token. Which configuration should they implement in cross-tenant access settings?
⚠ Common exam trap
Candidates often confuse session token revocation with conditional access policies or app restrictions, failing to realize that only the cross-tenant trust setting directly ties the external user's access to their home tenant's account status, enabling immediate revocation without waiting for token expiry.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure cross-tenant access settings to trust the user's account status from the home tenant.
Configuring cross-tenant access settings to trust the user's account status from the home tenant enables Azure AD to evaluate the external user's account state (enabled/disabled) in their home tenant at each authentication. When the partner user's account is disabled in their home tenant, Azure AD will deny access even if a valid session token exists, because the token's validity is rechecked against the home tenant's account status via the cross-tenant trust policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure cross-tenant access settings to trust the user's account status from the home tenant.
Why this is correct
Enabling 'Trust user's account' in Azure AD cross-tenant access inbound settings causes Azure AD to call the user's home tenant directory during each interactive token acquisition to verify the accountEnabled attribute. If the account is disabled or deleted in the home tenant, the sign-in is blocked immediately, regardless of any previously issued tokens. This is the only option that directly and continuously checks the external account's status, not just policies or device state.
- ✗
Configure external collaboration settings to restrict B2B users to specific apps.
Why it's wrong here
Restricting B2B users to specific apps through external collaboration settings only controls which enterprise applications they can launch after authentication succeeds. It does not perform any runtime validation of the user's account status with the home tenant, so a disabled user who already holds valid tokens can continue accessing the permitted apps until those tokens expire. The restriction addresses scope, not the user's existence or enabled state, which is why it fails to meet the requirement of immediate blocking.
- ✗
Assign a conditional access policy that requires device compliance for B2B users.
Why it's wrong here
A Conditional Access policy requiring device compliance evaluates the device's health, enrollment, or compliance state when the external user signs in. It does not query the home tenant's accountEnabled flag, nor does it invalidate tokens based on the user's employment status. A disabled B2B user on a compliant, corporate-managed device would still pass the policy because the check is entirely about the device, leaving the underlying account-status problem unaddressed.
- ✗
Enable Azure AD Identity Protection for B2B users.
Why it's wrong here
Azure AD Identity Protection applies risk-based policies that analyze sign-in behavior, leaked credentials, or anonymous IP addresses, producing a risk level for each authentication attempt. It does not fetch or evaluate the user's accountStatus from the home tenant, so a disabled account that presents no other risk signals would not be blocked. Identity Protection may supplement security but is not a substitute for trusting the home tenant's directory state, which is the only mechanism that reacts to account disablement at sign-in time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.