AZ-500 Secure identity and access Practice Question
You are a security administrator for a company that uses Microsoft Entra ID. You need to provide a partner organization with access to specific resources in your tenant. The partner users must use their own credentials, and you must be able to revoke access without managing their accounts. What should you configure?
⚠ Common exam trap
Candidates often confuse B2B collaboration with B2C or guest account management, which involve different identity models and administrative overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure B2B collaboration with a cross-tenant access policy that allows the partner tenant and grants access to a specific enterprise application.
B2B collaboration with cross-tenant access settings allows partner users to authenticate against their home tenant while you control which applications and resources they can access. Revocation is achieved by modifying or deleting the cross-tenant access policy or the application assignment, without managing partner accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure B2C authentication with a local account for each partner user.
Why it's wrong here
Azure AD B2C is intended for customer identity scenarios, not for partner collaboration. Creating local accounts for partner users means you manage their credentials, which conflicts with the requirement that they use their own credentials and that you avoid account management.
- ✗
Create an app registration and share the client secret with the partner organization.
Why it's wrong here
Sharing a client secret gives the partner an application identity, not a user identity, and secrets are difficult to revoke granularly. This does not let partner users sign in with their own credentials and violates the principle of not sharing credentials.
- ✗
Create guest user accounts in your tenant and assign them to a security group.
Why it's wrong here
Guest accounts can be used for external collaboration, but they require you to invite and manage each user in your tenant. The requirement is to avoid managing their accounts and to allow them to use their own credentials, so individual guest accounts add administrative overhead.
- ✓
Configure B2B collaboration with a cross-tenant access policy that allows the partner tenant and grants access to a specific enterprise application.
Why this is correct
Microsoft Entra B2B collaboration lets partner users authenticate with their home tenant credentials, and cross-tenant access policies control inbound access. You can scope access to specific applications and revoke it by changing the policy, without managing the partner's accounts.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.