The correct answer is to configure a Conditional Access policy targeting external users that requires MFA. This works because when a partner tenant does not support MFA, you cannot rely on cross-tenant trust settings to delegate authentication; instead, you enforce MFA directly in your own Microsoft Entra ID tenant, which will prompt the B2B guest users to register and complete MFA using your tenant’s authentication methods. On the AZ-500 exam, this scenario tests your understanding of how Conditional Access policies apply to guest users independently of their home tenant’s capabilities, and a common trap is assuming you must enable cross-tenant MFA trust or modify the partner tenant’s settings. The key insight is that your tenant can always require MFA for external users, even if their home tenant lacks it, because the MFA challenge is issued by your own Entra ID. Memory tip: “No trust, no problem—your policy, your MFA.”
AZ-500 Secure identity and access Practice Question
This AZ-500 practice question tests your understanding of secure identity and access. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are implementing a B2B collaboration solution in Microsoft Entra ID. You need to ensure that external users from a partner tenant can access your internal applications, but they must use MFA from their home tenant. The partner tenant does not support MFA. What should you do?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Conditional Access policy targeting external users that requires MFA
Option A is correct because you can configure a Conditional Access policy that targets external users (guest users) and requires MFA. Since the partner tenant does not support MFA, you cannot rely on cross-tenant trust; instead, you enforce MFA directly in your tenant using Microsoft Entra ID's own MFA capabilities. This ensures external users must complete MFA using your tenant's authentication methods, even if their home tenant lacks MFA support.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Configure a Conditional Access policy targeting external users that requires MFA
Why this is correct
You can enforce MFA directly for external users if their home tenant does not support MFA.
Related concept
Read the scenario before looking for a memorised answer.
✗
Configure cross-tenant access settings to trust MFA from the partner tenant
Why it's wrong here
Trusting MFA requires the partner tenant to support MFA.
✗
Use Microsoft Entra ID Governance to enforce MFA
Why it's wrong here
Identity Governance does not enforce MFA directly.
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume cross-tenant trust (Option B) is the only way to handle MFA for external users, but when the partner tenant lacks MFA, you must enforce MFA directly in your own tenant using Conditional Access.
Detailed technical explanation
How to think about this question
Under the hood, when you configure a Conditional Access policy targeting external users, Microsoft Entra ID evaluates the policy at sign-in and can require MFA using your tenant's authentication methods (e.g., Microsoft Authenticator, SMS, or OATH tokens). This works even if the external user's home tenant does not support MFA because the MFA challenge is issued by your tenant. In cross-tenant trust scenarios, the home tenant must issue a compliant MFA claim (via the MFA claim in the SAML or OIDC token), which is impossible if the partner tenant lacks MFA infrastructure.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Secure identity and access — This question tests Secure identity and access — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure a Conditional Access policy targeting external users that requires MFA — Option A is correct because you can configure a Conditional Access policy that targets external users (guest users) and requires MFA. Since the partner tenant does not support MFA, you cannot rely on cross-tenant trust; instead, you enforce MFA directly in your tenant using Microsoft Entra ID's own MFA capabilities. This ensures external users must complete MFA using your tenant's authentication methods, even if their home tenant lacks MFA support.
What should I do if I get this AZ-500 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.