SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to allow external business partners to access its internal applications using their own corporate credentials (e.g., their Microsoft Entra ID or Google account), without creating separate user accounts in the company's directory. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
A common mix-up: candidates confuse B2B collaboration (for business partners with existing corporate identities) with Azure AD B2C (for customers using social or local accounts), as both involve external users but serve fundamentally different scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
B2B collaboration
B2B collaboration allows the company to grant external business partners access to its internal applications using their own corporate identities (such as Microsoft Entra ID or Google accounts) without creating separate user accounts in the company's directory. It leverages federation trust and cross-tenant authentication, enabling partners to authenticate with their home organizations while accessing resources in the host tenant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AD B2C (Business-to-Consumer)
Why it's wrong here
Azure AD B2C is a distinct identity solution specifically designed for customer-facing applications, enabling organizations to manage millions of consumer identities. It allows end-users to sign up and sign in to applications using social identity providers (e.g., Google, Facebook) or local accounts. Unlike B2B collaboration, which focuses on business partners accessing internal resources, B2C is tailored for consumers interacting with public applications.
When this WOULD be correct
A company wants to allow customers to sign up and log in to a consumer-facing web application using their own social accounts (e.g., Facebook, Google) or email/password, without any existing corporate directory. The question specifies 'external business partners' and 'their own corporate credentials', which points to B2B, not B2C.
- ✓
B2B collaboration
Why this is correct
Microsoft Entra B2B collaboration enables organizations to securely share applications and resources with external business partners, allowing them to sign in using their own existing work, school, or social identities. This process creates a guest user object in the inviting organization's directory, which can then be granted access to specific resources, streamlining external access while maintaining control and minimizing administrative overhead.
- ✗
Microsoft Entra Domain Services
Why it's wrong here
Microsoft Entra Domain Services provides managed domain services, such as LDAP, Kerberos, and NTLM authentication, for cloud-based virtual machines and applications that require traditional domain controller functionality. It is designed to support legacy applications that cannot directly use modern authentication protocols, effectively extending a managed domain into Azure. However, it does not facilitate the federation or onboarding of external partner identities into Microsoft Entra ID.
When this WOULD be correct
A company needs to lift-and-shift on-premises applications that require domain-joined authentication to Azure VMs without managing domain controllers. Entra Domain Services would provide the managed domain services.
- ✗
Conditional Access
Why it's wrong here
Conditional Access is a powerful policy engine within Microsoft Entra ID that evaluates various signals, such as user, device, location, and application, to make real-time access decisions. It enforces specific controls, like multi-factor authentication or device compliance, *after* a user's identity has been established. While it can secure access for B2B guest users, it is an access control mechanism, not a service for enabling external users to bring their own identities into the directory.
When this WOULD be correct
A company wants to enforce MFA for all external partner access to its internal applications, regardless of the partner's identity provider. Conditional Access policies can be configured to require MFA for guest users from external tenants, making it the correct answer in that scenario.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓B2B collaborationCorrect answer▾
Why this is correct
Microsoft Entra B2B collaboration enables organizations to securely share applications and resources with external business partners, allowing them to sign in using their own existing work, school, or social identities. This process creates a guest user object in the inviting organization's directory, which can then be granted access to specific resources, streamlining external access while maintaining control and minimizing administrative overhead.
✗Azure AD B2C (Business-to-Consumer)Wrong answer — click to see why▾
Why this is wrong here
Azure AD B2C is designed for customer-facing identity management, allowing external users to sign up and log in with social or local accounts, but it requires creating user profiles in the B2C directory, not using their existing corporate credentials from other identity providers like Microsoft Entra ID or Google without separate accounts.
★ When this WOULD be the correct answer
A company wants to allow customers to sign up and log in to a consumer-facing web application using their own social accounts (e.g., Facebook, Google) or email/password, without any existing corporate directory. The question specifies 'external business partners' and 'their own corporate credentials', which points to B2B, not B2C.
Why candidates choose this
Candidates may confuse B2B (business-to-business) with B2C (business-to-consumer) due to similar acronyms, or assume that any external user scenario falls under B2C, not realizing that B2C is for consumers, not business partners with existing corporate identities.
✗Microsoft Entra Domain ServicesWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Domain Services provides managed domain services like domain join, group policy, and LDAP for legacy applications, not external identity federation for business partners.
★ When this WOULD be the correct answer
A company needs to lift-and-shift on-premises applications that require domain-joined authentication to Azure VMs without managing domain controllers. Entra Domain Services would provide the managed domain services.
Why candidates choose this
Candidates may confuse 'Domain Services' with identity services for external users, or think it supports federation because it integrates with Entra ID.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access is a policy engine that enforces access controls (e.g., MFA, device compliance) after authentication, but it does not enable external users to authenticate with their own corporate credentials. The question specifically asks for a feature that allows external partners to use their own identities, which is B2B collaboration, not Conditional Access.
★ When this WOULD be the correct answer
A company wants to enforce MFA for all external partner access to its internal applications, regardless of the partner's identity provider. Conditional Access policies can be configured to require MFA for guest users from external tenants, making it the correct answer in that scenario.
Why candidates choose this
Candidates may confuse Conditional Access with a feature that manages external identities because it is a powerful security tool often associated with access control for external users, but it does not handle identity federation or external authentication.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.