MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
An administrator wants to prevent users from inviting guest users from the domain 'contoso.com' to the tenant. The administrator needs to block all invitations for that specific domain while allowing invitations from all other external domains. Which setting in Microsoft Entra ID should be configured?
⚠ Common exam trap
Candidates often confuse 'Cross-tenant access settings' (which manage tenant-to-tenant trust and access) with 'External collaboration settings' (which control domain-level invitation restrictions), leading them to select Option A incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
External collaboration settings
External collaboration settings in Microsoft Entra ID (formerly Azure AD) allow administrators to configure domain-based restrictions for B2B collaboration invitations. By adding 'contoso.com' to the 'Deny list' under 'Cross-tenant access settings' or specifically within the 'External collaboration settings' blade, invitations to that domain are blocked while all other external domains remain allowed. This setting directly controls the guest invitation behavior at the domain level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-tenant access settings
Why it's wrong here
Cross-tenant access settings control B2B collaboration at the level of entire Microsoft Entra ID tenants, not individual e-mail domains. You can block a specific tenant ID or set trust settings, but you cannot add 'contoso.com' as a blocked domain unless that domain is isolated to one tenant. Since contoso.com could belong to any tenant, this setting cannot enforce a domain-wide guest invitation block.
- ✓
External collaboration settings
Why this is correct
External collaboration settings in Microsoft Entra ID contain the 'Collaboration restrictions' section where you can choose to allow invitations only to specified domains or block invitations to specific domains. Adding contoso.com to the 'Block invitations to the specified domains' list prevents users from inviting guest users whose email addresses use that domain. This is the correct administrative control for domain-based B2B invite restriction.
- ✗
User settings
Why it's wrong here
User settings in Microsoft Entra ID manage options such as self-service group creation, user registration, and allow or block users from signing in, but they do not include any domain-specific invitation restrictions. The ability to block guest invitations by domain is a separate capability scoped to the External collaboration settings page, not to user profile or user lifecycle settings. Therefore, configuring User settings cannot satisfy the requirement.
- ✗
Domain federation
Why it's wrong here
Domain federation configures an authentication trust between Microsoft Entra ID and an external identity provider, such as AD FS, using SAML or WS-Fed, for validating credentials of federated users. It does not manage B2B guest invitations or maintain a block list for e-mail domains. Federation is about how users authenticate, not about whether they can be added as guests, so it cannot prevent invitations to users at contoso.com.
Go deeper
Related to this question
Learn chapter
Emergency Access (Break-Glass) Accounts
Key term
Collaboration
Collaboration in Microsoft 365 refers to the integrated tools and services that enable people to work together in real time, share information, and coordinate tasks from anywhere.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.