SC-300 Implement and Manage User Identities Practice Question
An organization uses Microsoft Entra ID and needs to create external user accounts for contractors. The contractors should be invited by a select group of non-administrator employees without granting them full User Administrator privileges. Which administrative role should you assign to these employees?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Guest Inviter
Assigning the Guest Inviter role allows designated non-administrator employees to securely invite external B2B collaboration users without escalating their privileges to full User Administrator. This implements the principle of least privilege while enabling decentralized partner onboarding, reducing administrative overhead for core IT teams in enterprise environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
User Administrator
Why it's wrong here
Granting the User Administrator role provides excessive permissions across the entire directory, including the ability to manage credentials and administrative accounts, which violates the principle of least privilege required for simple contractor onboarding tasks.
- ✓
Guest Inviter
Why this is correct
The Guest Inviter role specifically empowers non-administrative users to invite external B2B guests into the Microsoft Entra tenant without granting broader directory management permissions, perfectly balancing administrative delegation and operational security.
- ✗
Helpdesk Administrator
Why it's wrong here
The Helpdesk Administrator role is designed for password resets, managing service requests, and reading user properties, but it lacks the explicit permissions required to generate and send B2B guest invitations to external users.
- ✗
Directory Readers
Why it's wrong here
The Directory Readers role is strictly limited to viewing basic user and group properties across the organization and does not possess any operational capability to initiate or manage external guest user invitations.
About these practice questions
One of 17 original SC-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-300 exam.