MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
You are configuring Microsoft Entra ID for a new organization. The CIO wants to ensure that all external users who are invited to collaborate via Microsoft Entra B2B must go through an approval process before gaining access. Which setting should you configure?
⚠ Common exam trap
Many exam-takers confuse post-authentication access controls (Conditional Access) with pre-invitation approval workflows (External collaboration settings), leading candidates to incorrectly select a Conditional Access policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set 'External collaboration settings' to restrict invitations to specific admins
The 'External collaboration settings' in Microsoft Entra ID allow you to restrict who can invite external users. By setting the invitation restriction to 'Only users assigned to specific admin roles can invite', you ensure that all B2B collaboration invitations must be initiated by authorized admins, effectively requiring an approval process before external users gain access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Conditional Access policy requiring approval for external users
Why it's wrong here
Conditional Access policies enforce access decisions at sign-in time based on conditions such as user, device, location, or risk, but they have no 'approval' grant or control action. The available grant controls are limited to Block, Grant access (optionally requiring MFA, compliant device, hybrid Microsoft Entra ID join, or terms of use), and session controls. Requiring a manual approval step for external users is outside the scope of Conditional Access; that capability belongs to an Entitlement Management access package approval workflow, not a Conditional Access policy.
- ✓
Set 'External collaboration settings' to restrict invitations to specific admins
Why this is correct
Under Microsoft Entra ID, go to External Identities > External collaboration settings and configure 'Guest invite restrictions' to 'Only users assigned to specific admin roles can invite guest users' (or the Guest Inviter role). This restricts invitation capability to authorized administrators, so any external user must be vetted by an admin before the invitation is sent, effectively acting as a mandatory approval gate. This is the correct control because it directly governs who may initiate external invitations and prevents regular users from bypassing oversight.
- ✗
Enable guest self-service sign-up via user flows
Why it's wrong here
Guest self-service sign-up via user flows lets external users register themselves for applications through a customizable portal experience without any pre-existing invitation. While user flows can collect attributes and assign them to an app, they do not include an approval step for inviting a specific user; they are designed to grant access automatically based on the flow's configuration. Enabling this would lower control over who gains access, which is the opposite of the approval requirement described in the question.
- ✗
Enable Identity Protection for guest users
Why it's wrong here
Identity Protection is an Entra ID service that detects risks such as impossible travel, leaked credentials, or anonymous IP addresses and can apply policies to block access or require MFA at sign-in. It does not include any approval workflow for user invitations, nor does it review or approve external users' requests to be added to tenant resources. Even though Identity Protection can cover guest users for risk-based policies, that capability is unrelated to controlling whether an external user is approved and invited.
Go deeper
Related to this question
Learn chapter
OneDrive Sharing Policies and External Access
Key term
Collaboration
Collaboration in Microsoft 365 refers to the integrated tools and services that enable people to work together in real time, share information, and coordinate tasks from anywhere.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.