How to Restrict External Users to Only Assigned Groups and Apps
You are managing a Microsoft Entra ID tenant with external collaboration enabled. You need to restrict external user access to only the groups and applications they are explicitly granted. You also want to prevent external users from seeing other external users in the tenant directory. Which settings should you configure?
Quick Answer
The correct answer is to set 'Guest user access restrictions' to 'Guest users have limited access...' and configure 'External collaboration settings' to restrict external user visibility. This combination works because the guest user access restrictions limit what external users can do within the tenant—such as preventing them from enumerating group membership or browsing the full directory—while the external collaboration settings specifically control the visibility of other external users in the tenant directory. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of Microsoft Entra ID’s granular permission boundaries, often appearing as a multi-select question where you must distinguish between access restrictions (which control permissions) and visibility settings (which control directory browsing). A common trap is confusing cross-tenant access settings with internal collaboration controls; remember that cross-tenant settings govern trust between organizations, not user-level restrictions. Memory tip: think “limited access + hidden users” to lock down external accounts to only their assigned groups and apps.
⚠ Common exam trap
Watch out — candidates often confuse 'Guest user access restrictions' with 'External collaboration settings', thinking they are interchangeable, but the former controls directory read permissions while the latter controls collaboration scope and visibility, and both are required to fully satisfy the scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set 'Guest user access restrictions' to 'Guest users have limited access...' and configure 'External collaboration settings' to restrict external user visibility
The 'Guest user access restrictions' setting controls the level of directory data guest users can see, and setting it to 'Guest users have limited access...' restricts guests from enumerating the full directory. Additionally, the 'External collaboration settings' allow you to limit guest visibility to only the groups and applications they are explicitly granted, preventing them from seeing other external users. This combination directly meets both requirements: restricting access to explicitly granted resources and hiding other external users from the directory.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set 'Guest user access restrictions' to 'Guest users have limited access...' and configure 'External collaboration settings' to restrict external user visibility
Why this is correct
This limits guest users to only objects they are assigned and prevents them from seeing other external users.
- ✗
Use Microsoft Entra entitlement management to create access packages for external users
Why it's wrong here
Entitlement management manages access packages but does not restrict directory visibility.
- ✗
Configure cross-tenant access settings to block all external collaboration
Why it's wrong here
This would block all external collaboration, not restrict it.
- ✗
Set 'Guest user access restrictions' to 'Guest users have same access as members'
Why it's wrong here
This gives external users full access, not restricted.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that external users who are invited to collaborate via Microsoft Entra B2B can only access the applications assigned to them. Which configuration should you use?
easy- A.Require guest users to register for MFA before accessing any applications.
- ✓ B.Create a Conditional Access policy that applies to guest users and targets the specific applications.
- C.Configure cross-tenant access settings to block all applications except those assigned.
- D.Configure SharePoint external sharing settings to limit application access.
Why B: Conditional Access policies in Microsoft Entra ID can be scoped to guest/external users and specific applications, allowing you to enforce access controls such as requiring MFA or blocking access for unapproved apps. This directly meets the requirement to restrict B2B guest users to only the applications assigned to them, without affecting other sign-in behaviors or tenant-wide settings.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.