SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
An organization wants to provide a secure way for external partners to access specific SharePoint sites without creating new user accounts. What Microsoft Entra B2B feature should they use?
⚠ Common exam trap
Many candidates confuse B2B collaboration (for external partner access with existing identities) with Azure AD B2C (for customer-facing identity management), or mistakenly think Direct federation is required for partner access when B2B collaboration already handles the invitation and redemption process without creating new accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
B2B collaboration
B2B collaboration is the correct Microsoft Entra B2B feature because it allows external partners to access specific SharePoint sites using their own identities (e.g., work or social accounts) without requiring new user accounts or passwords to be created in the organization's tenant. This is achieved through invitation-based redemption, where the partner user is represented as a guest user object in the directory, enabling fine-grained access control via SharePoint site sharing policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AD B2C
Why it's wrong here
Azure AD B2C is designed for consumer-facing applications, allowing organizations to manage identities for millions of customers, partners, and citizens. It provides a highly scalable identity solution where users sign up and sign in to applications using local accounts or social identity providers. While it handles external users, its primary use case is for customer identity and access management (CIAM) for applications, not for enabling secure collaboration between organizations or with individual external users accessing internal resources.
- ✗
Direct federation
Why it's wrong here
Direct federation involves establishing a one-to-one trust relationship between an organization's Azure AD tenant and another organization's on-premises identity provider (like ADFS) or another cloud IdP. This setup requires significant configuration and maintenance for each federated domain, making it suitable for specific, long-term partnerships with dedicated identity infrastructure. It is less flexible and scalable for ad-hoc or broad external collaboration compared to Azure AD's native B2B capabilities.
- ✗
Azure AD Domain Services
Why it's wrong here
Azure AD Domain Services (AAD DS) provides managed domain services, such as domain join, group policy, LDAP, and Kerberos/NTLM authentication, for Azure virtual machines and legacy applications. It extends Azure AD to provide a traditional domain controller experience without deploying and managing domain controllers yourself. AAD DS is specifically designed to support IaaS workloads and lift-and-shift applications that require traditional domain services, and it does not facilitate secure external user collaboration.
- ✓
B2B collaboration
Why this is correct
Azure AD B2B collaboration allows organizations to securely invite external users, such as partners, vendors, or customers, to access their applications and resources while letting these users sign in with their own identities. This includes identities from other Azure AD tenants, social identity providers (like Google or Microsoft accounts), or even email one-time passcodes. It provides a streamlined and secure method for external users to access shared resources without creating new credentials in the inviting organization's directory, maintaining strong security controls and compliance.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.