SC-300 Implement and Manage User Identities Practice Question
You want to allow external users to sign in to your Microsoft Entra tenant using their Google accounts. Which TWO steps are required to configure Google federation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Google Cloud Platform project and obtain a Client ID and Client Secret.
Federating with social identity providers like Google improves the onboarding experience for B2B guests by allowing them to use familiar credentials. This reduces the need for them to manage a separate password for your tenant and leverages the security features of their existing identity provider, such as Google's own multi-factor authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Google Cloud Platform project and obtain a Client ID and Client Secret.
Why this is correct
To enable federation, you must register your Entra ID tenant as an application within the Google Developers Console. This process generates the necessary OAuth 2.0 credentials (Client ID and Secret) that Entra ID uses to communicate with Google's identity services and verify the identity of the signing-in user.
- ✗
Enable the 'Email one-time passcode for guests' setting in the Entra admin center.
Why it's wrong here
Email one-time passcode (OTP) is a fallback mechanism for guests who do not have a Microsoft or federated account. While it is a useful feature for general B2B collaboration, it is distinct from Google federation and is not a prerequisite for setting up a dedicated social identity provider.
- ✓
Configure Google as an identity provider in the 'External Identities' section of Entra ID.
Why this is correct
Once you have the credentials from Google, you must input them into the Entra ID configuration. This step establishes the trust relationship and tells Entra ID to offer the 'Google' sign-in option to invited guest users whose email addresses correspond to the Google identity domain.
- ✗
Assign a Microsoft Entra ID P2 license to every Google user who will sign in.
Why it's wrong here
Licensing for external users is based on the Monthly Active Users (MAU) model, where the first 50,000 guests are typically free. You do not need to assign individual P2 licenses to every guest; the tenant's features (like MFA) are extended to guests based on the tenant's own licensing level.
- ✗
Configure a custom domain in Entra ID that matches the @gmail.com suffix.
Why it's wrong here
You cannot add '@gmail.com' as a custom domain in your Entra ID tenant because you do not own the DNS for it. Federation works by redirecting the user to Google for authentication, and it does not require the external domain to be verified or added to your own tenant's domain list.
About these practice questions
One of 17 original SC-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-300 exam.