SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and requires that all guest users from a partner organization must sign in using Microsoft Authenticator for MFA. The partner organization manages their own identities. What should you configure?
⚠ Common exam trap
It's easy for candidates to assume a Conditional Access policy (Option D) is the standard way to enforce MFA for guests, but they overlook the cross-tenant trust mechanism that allows the partner to manage their own MFA without guest user registration in the resource tenant.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure cross-tenant access settings to trust MFA from the partner's Microsoft Entra ID tenant
Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA claims from an external partner's tenant. Since the partner manages their own identities, trusting their MFA ensures that guest users from that partner organization can satisfy MFA requirements using their own Microsoft Authenticator without needing to register again in your tenant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Microsoft Entra ID Protection and configure MFA registration policy for guests
Why it's wrong here
Microsoft Entra ID Protection's MFA registration policy is designed to enforce the registration of multi-factor authentication methods within your own tenant. It does not provide a mechanism to accept or trust MFA claims that have already been performed and validated by a guest user's home tenant. Consequently, this approach would still require guests to register for and perform MFA within your tenant, failing to meet the requirement of trusting the partner's MFA.
- ✗
Use Microsoft Entra ID Governance to require access reviews for guests
Why it's wrong here
Microsoft Entra ID Governance, specifically the access reviews feature, is primarily used for periodically reviewing and certifying user access rights to resources. Its purpose is to ensure that users, including guests, maintain only the necessary permissions over time, supporting compliance and least privilege principles. This functionality is entirely distinct from enforcing or trusting multi-factor authentication during the sign-in process, making it irrelevant to the question's core requirement.
- ✓
Configure cross-tenant access settings to trust MFA from the partner's Microsoft Entra ID tenant
Why this is correct
Cross-tenant access settings offer granular control over how users from other Microsoft Entra ID tenants interact with your resources. By configuring inbound trust settings, your tenant can be explicitly set to accept multi-factor authentication claims issued by the partner's home tenant. This crucial capability eliminates redundant MFA prompts for guest users, allowing your organization to leverage the partner's security controls and provide a seamless, yet secure, access experience.
- ✗
Create a Conditional Access policy that requires MFA for guest users
Why it's wrong here
While a Conditional Access policy can effectively require multi-factor authentication for guest users accessing resources within your tenant, it enforces *your* tenant's MFA requirements. This means that even if a guest has already completed MFA in their home tenant, they would be prompted to perform MFA again within your tenant. Conditional Access policies do not inherently provide the functionality to trust MFA claims originating from a partner's Microsoft Entra ID tenant, leading to duplicate authentication challenges.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.