Courseiva
Describe the capabilities of Microsoft EntramediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

A company wants to allow external business partners to access its internal applications using their own corporate credentials (e.g., their Microsoft Entra ID or Google account), without creating separate user accounts in the company's directory. Which Microsoft Entra ID feature should they use?

⚠ Common exam trap

A common mix-up: candidates confuse B2B collaboration (for business partners with existing corporate identities) with Azure AD B2C (for customers using social or local accounts), as both involve external users but serve fundamentally different scenarios.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

B2B collaboration

B2B collaboration allows the company to grant external business partners access to its internal applications using their own corporate identities (such as Microsoft Entra ID or Google accounts) without creating separate user accounts in the company's directory. It leverages federation trust and cross-tenant authentication, enabling partners to authenticate with their home organizations while accessing resources in the host tenant.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Azure AD B2C (Business-to-Consumer)

    Why it's wrong here

    Azure AD B2C is a distinct identity solution specifically designed for customer-facing applications, enabling organizations to manage millions of consumer identities. It allows end-users to sign up and sign in to applications using social identity providers (e.g., Google, Facebook) or local accounts. Unlike B2B collaboration, which focuses on business partners accessing internal resources, B2C is tailored for consumers interacting with public applications.

    When this WOULD be correct

    A company wants to allow customers to sign up and log in to a consumer-facing web application using their own social accounts (e.g., Facebook, Google) or email/password, without any existing corporate directory. The question specifies 'external business partners' and 'their own corporate credentials', which points to B2B, not B2C.

  • B2B collaboration

    Why this is correct

    Microsoft Entra B2B collaboration enables organizations to securely share applications and resources with external business partners, allowing them to sign in using their own existing work, school, or social identities. This process creates a guest user object in the inviting organization's directory, which can then be granted access to specific resources, streamlining external access while maintaining control and minimizing administrative overhead.

  • Microsoft Entra Domain Services

    Why it's wrong here

    Microsoft Entra Domain Services provides managed domain services, such as LDAP, Kerberos, and NTLM authentication, for cloud-based virtual machines and applications that require traditional domain controller functionality. It is designed to support legacy applications that cannot directly use modern authentication protocols, effectively extending a managed domain into Azure. However, it does not facilitate the federation or onboarding of external partner identities into Microsoft Entra ID.

    When this WOULD be correct

    A company needs to lift-and-shift on-premises applications that require domain-joined authentication to Azure VMs without managing domain controllers. Entra Domain Services would provide the managed domain services.

  • Conditional Access

    Why it's wrong here

    Conditional Access is a powerful policy engine within Microsoft Entra ID that evaluates various signals, such as user, device, location, and application, to make real-time access decisions. It enforces specific controls, like multi-factor authentication or device compliance, *after* a user's identity has been established. While it can secure access for B2B guest users, it is an access control mechanism, not a service for enabling external users to bring their own identities into the directory.

    When this WOULD be correct

    A company wants to enforce MFA for all external partner access to its internal applications, regardless of the partner's identity provider. Conditional Access policies can be configured to require MFA for guest users from external tenants, making it the correct answer in that scenario.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

B2B collaborationCorrect answer

Why this is correct

Microsoft Entra B2B collaboration enables organizations to securely share applications and resources with external business partners, allowing them to sign in using their own existing work, school, or social identities. This process creates a guest user object in the inviting organization's directory, which can then be granted access to specific resources, streamlining external access while maintaining control and minimizing administrative overhead.

Azure AD B2C (Business-to-Consumer)Wrong answer — click to see why

Why this is wrong here

Azure AD B2C is designed for customer-facing identity management, allowing external users to sign up and log in with social or local accounts, but it requires creating user profiles in the B2C directory, not using their existing corporate credentials from other identity providers like Microsoft Entra ID or Google without separate accounts.

★ When this WOULD be the correct answer

A company wants to allow customers to sign up and log in to a consumer-facing web application using their own social accounts (e.g., Facebook, Google) or email/password, without any existing corporate directory. The question specifies 'external business partners' and 'their own corporate credentials', which points to B2B, not B2C.

Why candidates choose this

Candidates may confuse B2B (business-to-business) with B2C (business-to-consumer) due to similar acronyms, or assume that any external user scenario falls under B2C, not realizing that B2C is for consumers, not business partners with existing corporate identities.

Microsoft Entra Domain ServicesWrong answer — click to see why

Why this is wrong here

Microsoft Entra Domain Services provides managed domain services like domain join, group policy, and LDAP for legacy applications, not external identity federation for business partners.

★ When this WOULD be the correct answer

A company needs to lift-and-shift on-premises applications that require domain-joined authentication to Azure VMs without managing domain controllers. Entra Domain Services would provide the managed domain services.

Why candidates choose this

Candidates may confuse 'Domain Services' with identity services for external users, or think it supports federation because it integrates with Entra ID.

Conditional AccessWrong answer — click to see why

Why this is wrong here

Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) after authentication, but it does not enable external users to authenticate with their own corporate credentials. The question specifically asks for a feature that allows external partners to use their own identities, which is B2B collaboration, not Conditional Access.

★ When this WOULD be the correct answer

A company wants to enforce MFA for all external partner access to its internal applications, regardless of the partner's identity provider. Conditional Access policies can be configured to require MFA for guest users from external tenants, making it the correct answer in that scenario.

Why candidates choose this

Candidates may confuse Conditional Access with a feature that manages external identities because it is a powerful security tool often associated with access control for external users, but it does not handle identity federation or external authentication.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

About these practice questions

One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.