MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your organization needs to manage guest access to Microsoft Teams. Which TWO methods can you use to control guest access?
⚠ Common exam trap
Many exam-takers confuse the separate layers of control—Teams-specific settings (admin center) versus tenant-wide identity settings (Entra ID)—and may think that only one of these two correct options is needed, or that SharePoint settings (Option B) are sufficient for Teams guest access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable guest access in the Teams admin center.
Enabling guest access in the Teams admin center is a required step to allow guest users to join Teams. Without this toggle enabled, guest access is blocked at the Teams level regardless of other settings. This setting works in conjunction with Microsoft Entra ID external collaboration settings to control guest access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use sensitivity labels to restrict guest access.
Why it's wrong here
Sensitivity labels apply protection and governance rules—such as encryption, visual markings, and content access controls—to documents and emails. They do not contain a tenant-wide switch that enables or disables the actual ability to add a guest account to a Microsoft Teams team. While a label can restrict who can open a specific file, it cannot grant or revoke the underlying guest membership capability in Teams.
- ✗
Configure SharePoint Online external sharing settings.
Why it's wrong here
SharePoint Online external sharing settings control how sites, folders, and files are shared with external users through links, site sharing, and anonymous access. Even though Teams uses SharePoint for its file storage layer, these settings do not determine whether a guest can be added to the team’s membership list. You can enable SharePoint external sharing without turning on the Teams guest access toggle, so it is not the correct control for enabling guest capability at the team level.
- ✓
Enable guest access in the Teams admin center.
Why this is correct
In the Microsoft Teams admin center, the Org-wide settings > Guest access section includes an 'Allow guest access in Microsoft Teams' toggle that must be set to On. This setting is the Teams-specific control that admits guest accounts into the team membership and lets them participate in channels and chats. Without this toggle enabled, guests cannot be added to a team even if Microsoft Entra ID allows B2B collaboration invitations. Thus, enabling guest access in the Teams admin center is a required step to support guest collaboration in Teams.
- ✗
Set conditional access policies for guest users.
Why it's wrong here
Conditional Access policies are evaluated after sign-in and apply conditions such as device compliance, location, and sign-in risk to enforce access requirements for users, including guests. They can block a guest’s access or force MFA, but they do not provide a mechanism to invite guest accounts or flip the guest access feature on in Teams. Configuring a Conditional Access policy that targets guests is an access control measure, not an enablement control for team membership.
- ✓
Configure external collaboration settings in Microsoft Entra ID.
Why this is correct
Microsoft Entra ID external collaboration settings, found under External Identities > External collaboration settings, govern tenant-wide permissions for B2B guest invitations and specify who can invite guests. To allow guests in Teams, these settings must permit user invitations and enable B2B collaboration so that guest accounts can actually be created. This identity-layer configuration works alongside the Teams admin center toggle; if Entra ID blocks invitations, no guest accounts can be added to Teams. Therefore, configuring these settings is a correct and necessary way to manage guest access at the directory level.
Go deeper
Related to this question
Learn chapter
SharePoint External Sharing and Guest Policies
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Guest access
Guest access allows a user to temporarily connect to a network, application, or shared resource with limited permissions, without being a permanent member of the organization.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.