MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
You need to grant a vendor access to a specific SharePoint Online site for a limited time. The vendor does not have an account in your Microsoft Entra ID. What should you use?
⚠ Common exam trap
Candidates often confuse B2B collaboration with creating a new user account (Option A) or assume that self-service sign-up (Option B) is appropriate for a single vendor, when in fact B2B collaboration is the correct method for granting external users time-limited access without managing their identities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Entra B2B collaboration and set an expiration for the guest user
Microsoft Entra B2B collaboration allows you to invite external users (vendors) as guest users to access your organization's resources, including SharePoint Online sites, without requiring them to have an existing account in your tenant. You can configure an expiration policy for the guest user account to automatically remove access after a specified period, meeting the requirement for limited-time access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a user account via Microsoft Entra Connect
Why it's wrong here
Microsoft Entra Connect is a directory synchronization tool that replicates on-premises AD objects into Microsoft Entra ID, creating regular (non-guest) user identities tied to your domain. It does not create external identities and has no built-in expiration mechanism for vendor access, making it unsuitable for time-limited sharing of a SharePoint site with an outside collaborator. The vendor would require a full on-premises account and lifecycle management, which defeats the purpose of external collaboration.
- ✗
Configure self-service sign-up user flow
Why it's wrong here
Configuring a self-service sign-up user flow enables users from within your own organization—or the public at large—to register for an application and receive a local account in your tenant, not an external vendor identity. This mechanism does not support B2B invitation semantics, nor does it apply guest expiration policies, so a vendor would remain indefinitely and outside the intended access-control model. Any external user created this way becomes a member of your directory rather than a guest with the required time-bound access.
- ✗
Assign the vendor a guest user account with no expiration
Why it's wrong here
Simply assigning a guest user account without configuring an expiration date leaves the vendor with standing access to SharePoint, which violates the principle of least privilege and expands your attack surface indefinitely. While Microsoft Entra ID does allow an expiration policy for guest users, it is not enabled by default; omitting this step means the access will never automatically revoke. This option fails the requirement to grant time-limited vendor access and requires manual administrative intervention later.
- ✓
Use Microsoft Entra B2B collaboration and set an expiration for the guest user
Why this is correct
Microsoft Entra B2B collaboration is the intended mechanism for inviting external vendors, because it creates a guest user identity that can be scoped to specific resources such as a SharePoint site. Combined with the guest user expiration policy in Entra ID, you can specify a fixed number of days before the account becomes inactive, enforcing time-bound access without any manual offboarding. This approach aligns with zero-trust principles and ensures the vendor's access automatically expires after the engagement.
Go deeper
Related to this question
Learn chapter
Entra Connect Health Monitoring
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.