CCNA Entra Capabilities Questions

A Conditional Access policy requiring a compliant device ensures that only devices meeting specific security baselines, as defined and monitored by Microsoft Intune, can access corporate resources. This enforces device health and configuration, ensuring the device adheres to organizational security standards. Microsoft Intune App Protection Policies (MAM) provide a crucial layer of data protection within applications, preventing corporate data from being copied, pasted, or saved to unmanaged applications or personal storage locations, even on unmanaged devices. Together, these policies establish both device-level security posture and application-level data leakage prevention, directly addressing the need to protect data and enforce compliance.

Microsoft Entra Entitlement Management is a robust identity governance feature that automates the lifecycle of access requests and approvals for internal and external users. It allows organizations to define access packages, which bundle resources and policies, enabling self-service access requests and ensuring users have appropriate permissions based on their role or project. This capability streamlines the process of granting and revoking access, reducing manual overhead and improving security posture.

Microsoft Entra Conditional Access session controls, when integrated with Defender for Cloud Apps, provides granular, real-time control over user sessions *after* initial authentication. Conditional Access policies can route sessions through Defender for Cloud Apps (formerly MCAS) for continuous monitoring, allowing actions like blocking downloads, requiring re-authentication, or enforcing read-only access based on detected risky behavior *during* the session, not just at sign-in. This combination directly addresses the need for ongoing session control and behavioral enforcement.

Microsoft Entra External ID is the comprehensive solution for managing and securing identities for external users, including partners, customers, and consultants. It enables organizations to collaborate securely by allowing these external users to sign in with their own identities, such as those from other Microsoft Entra tenants, social identity providers like Google or Facebook, or even via email one-time passcodes. This service specifically facilitates the onboarding and management of external users for resource access without creating full internal accounts.

Self-Service Password Reset (SSPR) is a crucial Microsoft Entra ID feature that empowers users to reset their forgotten or locked-out passwords without requiring administrator assistance. Users authenticate their identity through pre-registered verification methods, such as a mobile app notification, phone call, or personal email, to prove they are legitimate. This capability directly addresses the scenario where a user cannot sign in because they have forgotten their password, allowing them to regain access independently.

Microsoft Entra entitlement management is the correct solution as it allows organizations to manage identity and access lifecycle for both internal and external users at scale. It enables the creation of 'access packages' that bundle resources and define policies, including explicit expiration dates for assignments. When access is granted via an access package, it is automatically revoked upon the specified expiration, ensuring time-limited access.

Microsoft Entra Conditional Access is the policy engine that evaluates various signals in real-time, such as user identity, location, application, and device state, to make granular access decisions. To enforce device compliance, a Conditional Access policy is configured to require that a device be marked as compliant by an MDM solution like Intune before granting access to protected resources. This directly controls access based on the device's adherence to organizational security standards.

This option utilizes two distinct grant controls within a Conditional Access policy, directly addressing the requirements. "Require multifactor authentication" ensures users provide a second verification factor, significantly enhancing security at the point of access. Concurrently, "Require terms of use" mandates that users review and explicitly accept a specified document before they are permitted to access the protected resource, directly fulfilling both stated requirements for initial access.

Microsoft Entra ID natively provides robust multifactor authentication (MFA) capabilities, allowing organizations to enforce an additional layer of security beyond just a password. Users can verify their identity through various methods like authenticator apps, biometrics, or security keys, significantly reducing the risk of unauthorized access from compromised credentials. This capability is central to a strong identity and access management strategy within the Microsoft cloud ecosystem.

Microsoft Entra ID Access Reviews enable organizations to efficiently manage group memberships, access to applications, and role assignments by creating recurring review campaigns. These campaigns empower designated reviewers, often resource owners, to periodically attest to the continued need for access for each member. Upon completion of the review period, Access Reviews can automatically remove users whose access was not approved, ensuring the principle of least privilege and reducing stale access. This directly addresses the need for periodic review and removal of access.

In Azure AD Conditional Access, the "Conditions" section allows administrators to define specific criteria for policy application. The "Client apps" condition specifically targets the type of client application attempting to access resources, including options to block "Other clients," which encompasses legacy authentication protocols like POP3, IMAP, SMTP, and older Office clients. By selecting this option, organizations can enforce the exclusive use of modern authentication clients, significantly enhancing security by eliminating vulnerabilities associated with less secure, basic authentication methods.

Conditional Access policies in Microsoft Entra ID are the primary mechanism for enforcing granular access controls based on specific conditions. These policies evaluate various signals, such as user or group membership, application being accessed, device state (e.g., compliant or hybrid joined), and location, to determine whether to grant access, block access, or require additional authentication like multi-factor authentication (MFA) or a compliant device. This directly addresses the need to enforce a policy based on group membership and device compliance for application access.

Microsoft Entra ID Protection's sign-in risk policy directly evaluates the risk associated with a specific sign-in attempt in real-time. When configured to block access for a detected risk level, such as 'High,' it prevents the user from completing the sign-in immediately. This directly addresses the requirement to automatically block a high-risk sign-in, ensuring immediate protection against potentially compromised credentials and unauthorized access.

A Decentralized Identifier (DID) is the foundational element for an organization to act as an issuer in Microsoft Entra Verified ID. This globally unique, self-owned identifier is published to a decentralized ledger (e.g., ION) and contains the public keys and service endpoints necessary for cryptographic operations, such as signing verifiable credentials. The DID cryptographically anchors the organization's verifiable identity, enabling holders and verifiers to trust the authenticity and integrity of the credentials issued.

Configuring 'Remember MFA' settings, typically through the 'Sign-in frequency' control within a Conditional Access policy, allows administrators to specify how often users are prompted for MFA. By setting a longer duration, such as 90 days, users on trusted devices can remain authenticated without repeated MFA challenges for that period. This balances security with user experience by reducing prompt fatigue while maintaining strong authentication.

Microsoft Entra ID Governance Lifecycle Workflows provide automated identity lifecycle management, enabling organizations to define and execute tasks based on HR-driven events like joining, moving, or leaving. This feature can automatically provision or deprovision access to applications and resources, ensuring that when an employee departs, their access is systematically revoked without manual intervention, aligning directly with the requirement to remove access based on HR events.

Microsoft Entra Identity Governance Access Reviews enable organizations to manage the lifecycle of user access, particularly for guest accounts. They facilitate periodic reviews by resource owners or managers to certify continued access, ensuring compliance and security. These reviews can be automated to remove access for users who are not re-approved or have shown no activity for a defined period, directly addressing the need for guest account management and cleanup. This capability is crucial for maintaining a clean and secure identity posture by preventing stale accounts.

Azure AD Identity Protection's primary function involves identifying various identity-based risks in real-time through sophisticated machine learning and heuristics. This includes detecting suspicious activities such as sign-ins from anonymous IP addresses, impossible travel scenarios, or the use of leaked credentials found on the dark web. These granular risk detections are crucial for understanding potential compromises and informing subsequent security actions.

Microsoft Entra ID Protection is the dedicated service for detecting identity-based risks, including both sign-in risk and user risk, using adaptive machine learning and heuristics. It continuously monitors sign-in attempts and user behavior for anomalies like impossible travel, unfamiliar sign-in properties, or leaked credentials. Based on these detections, Identity Protection can automatically trigger responses such as requiring multi-factor authentication, enforcing a password change, or blocking access, thereby directly addressing the need for risk-based MFA.

Device platform is a fundamental condition in Microsoft Entra Conditional Access, enabling administrators to specify which operating systems a policy applies to. This condition allows for highly granular control, such as requiring compliant devices only for specific platforms like iOS and Android, while potentially blocking access from less secure or unsupported platforms like Linux or macOS unless they meet additional criteria. It directly evaluates the OS of the device initiating the access request.

Conditional Access policies provide the precise control needed to block legacy authentication by evaluating various conditions, including the client application used for access. Administrators can configure a policy to specifically target and block client apps that utilize legacy authentication protocols, such as Exchange ActiveSync or 'Other clients' (which often encompasses protocols like POP3, IMAP, and SMTP AUTH). This ensures that only modern authentication methods, which support features like multi-factor authentication, are permitted for accessing corporate resources.

Microsoft Entra Entitlement Management is a core component of identity governance, automating the lifecycle of access to groups, applications, and SharePoint sites. It allows organizations to define access packages, specify approval workflows, and enable self-service requests, ensuring users gain and lose access appropriately and efficiently based on their roles and projects. This capability streamlines the process of granting and revoking access, reducing manual overhead and improving compliance.

Microsoft Entra ID Protection actively monitors public and dark web sources for compromised user credentials associated with your tenant. When a username and password pair is found to be leaked, ID Protection flags the affected user as having a "leaked credentials" risk, enabling administrators to force password resets or block sign-ins to prevent unauthorized access. This proactive monitoring is a critical defense against credential stuffing attacks.

Microsoft Entra Self-Service Password Reset (SSPR) is the correct solution because it directly addresses the need for users to reset their own passwords without requiring administrator intervention. This feature allows users to verify their identity using pre-registered authentication methods, such as mobile app notifications, phone calls, or email verification, to securely regain access to their accounts. SSPR significantly reduces helpdesk call volumes related to password resets and improves user productivity by providing immediate self-service access restoration.

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications from any device, without requiring a VPN or opening inbound firewall ports. It works by deploying a lightweight connector within the private network that establishes an outbound connection to the Microsoft Entra service. This allows users to access internal applications using their Microsoft Entra ID credentials, benefiting from single sign-on and Microsoft Entra's robust security features like Conditional Access.

Microsoft Entra External ID is purpose-built as a robust Customer Identity and Access Management (CIAM) solution, specifically engineered to manage identities for millions of external customers accessing applications and services. It natively supports a wide array of identity providers, including popular social accounts (e.g., Google, Facebook), enterprise accounts, and local accounts. Furthermore, it offers extensive customization capabilities for sign-up, sign-in, and profile management pages, ensuring a fully branded and user-friendly experience tailored for external customers.

PIM provides just-in-time privileged access with approval workflows and time-bound role assignments. Administrators can activate roles only after approval and for a specified duration. This directly meets the requirement for approval and time-bound activations. PIM also provides audit logs and access reviews, enhancing security and compliance for privileged roles.

Microsoft Entra Verified ID is the dedicated service for implementing decentralized identity and managing verifiable credentials (VCs). It enables organizations to issue digital attestations, such as proof of employment or qualifications, to individuals, who then hold these VCs in a digital wallet. This service facilitates a trust framework where issuers can attest to facts about a user, and verifiers can cryptographically confirm the authenticity of these credentials without relying on a central authority, directly addressing the need for verifiable identity proofs.

Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources. It enables just-in-time (JIT) access, meaning users are assigned privileged roles only when needed and for a limited duration. Requiring approval for role activation ensures an additional layer of control, while access reviews provide periodic verification that users still require their assigned privileges, enforcing the principle of least privilege.

The PowerShell script utilizes the `New-MgUserAuthenticationPhoneMethod` cmdlet, which is specifically designed to add a new phone authentication method to a specified user's authentication methods in Microsoft Entra ID. This action registers a phone number, making it available for use in scenarios such as SMS-based multifactor authentication or passwordless sign-in, but does not inherently enable MFA itself. It's a foundational step for phone-based authentication.

Conditional Access policies are the primary method in Microsoft Entra ID for enforcing granular access controls, including multi-factor authentication (MFA). They evaluate conditions such as user, device, location, and application to determine if access should be granted, blocked, or require additional authentication methods like MFA, making them highly flexible for enforcing specific security requirements across an organization.

Conditional Access policies are the primary mechanism in Azure AD for enforcing specific access controls based on various conditions, including user attributes, device state, location, and client applications. To effectively block legacy authentication, a Conditional Access policy can be configured to target 'Other clients' or 'Exchange ActiveSync clients' and then apply a 'Block access' grant control. This prevents older protocols such as POP, IMAP, and SMTP from authenticating, thereby mitigating associated security risks by forcing the use of modern authentication.

For a Conditional Access policy to effectively target and block specific client application types, such as "Exchange ActiveSync clients" or "Other clients" (which often represent legacy authentication protocols), the `ClientAppTypes` condition must be explicitly configured. If this condition is empty or not selected, the policy will not apply to any particular client application type, thus failing to block legacy authentication attempts originating from those specific clients.

Within Microsoft Entra Permissions Management, the Activity trail component meticulously records all user and resource actions performed across connected cloud environments, including AWS, Azure, and GCP. This comprehensive log details who accessed what resource, when, and how, providing critical visibility into the actual usage of granted permissions. It is essential for detecting anomalous behavior, identifying potential misuse of entitlements, and understanding the real-world impact of permission policies.

Microsoft Entra ID Identity Protection actively monitors and analyzes sign-in attempts and user behavior to identify potential threats. This capability includes detecting various anomalies, such as sign-ins from anonymous IP addresses, unfamiliar locations, or impossible travel scenarios, which are strong indicators of compromised credentials or malicious activity. It continuously assesses risk levels for each identity.

Phone call (voice call) is a supported multi-factor authentication method where Microsoft Entra ID initiates an automated voice call to a user's registered phone number. To complete authentication, the user must answer the incoming call and typically press a specific key, such as the # key, on their phone's keypad to confirm their identity. This directly fulfills the requirement of a phone call for user verification.

Microsoft Entra Conditional Access policies are the primary mechanism for enforcing access controls based on specific conditions, such as user location, device state, or application being accessed. By defining a policy that targets all users and requires MFA, an administrator can then create an exception for trusted IP ranges, effectively bypassing MFA when users are on the corporate network. This granular control over access based on real-time signals is central to Microsoft Entra ID P2 security capabilities.

Microsoft Entra Application Proxy is the correct solution for securely publishing on-premises web applications to external users. It achieves this by deploying a lightweight connector within the on-premises network, which establishes an outbound connection to Azure, creating a secure tunnel. This allows users to access internal web apps remotely with single sign-on capabilities, leveraging Entra ID's conditional access policies without requiring a VPN or opening inbound firewall ports.

This is the fundamental and most direct method to control which users or groups are authorized to access a specific enterprise application in Microsoft Entra ID. By assigning a group like 'SalesTeam' to the CRM application, you explicitly provision access for all members of that group, ensuring only authorized individuals can sign in and utilize the application. This method establishes the baseline access permissions for the application.

Microsoft Entra B2B (Business-to-Business) collaboration is the appropriate solution for enabling partner users to access applications and resources within your organization using their existing corporate or social identities. This feature creates guest user objects in your directory, allowing external users to authenticate with their home identity provider while granting them controlled access to your Microsoft Entra ID-protected resources without requiring complex federation setup.

Access Reviews are specifically designed for periodically reviewing user access to resources, including guest users. By configuring an Access Review to auto-apply results, access can be automatically revoked if reviewers do not respond or deny access. Crucially, the 'Delete users' setting within the review can be enabled to automatically remove guest user objects from Microsoft Entra ID after a specified number of days if their access is denied or not re-certified, directly addressing the need for automated guest cleanup.

This is the correct approach because Microsoft Entra Conditional Access policies, combined with authentication strengths, are designed to enforce specific authentication methods. By configuring a policy to 'Require authentication strength' and selecting 'Passwordless MFA', administrators can explicitly mandate that users authenticate using only passwordless methods, such as FIDO2 security keys or Windows Hello for Business. This effectively blocks any sign-in attempt that relies on a password as the primary credential, thereby achieving a truly passwordless environment.

Microsoft Entra External ID (B2C) is specifically engineered to manage customer identities for consumer-facing applications and services, such as an e-commerce website. It enables users to sign up and sign in using their preferred social identity providers, such as Google, Facebook, or Apple, or by creating a local account. This service provides highly customizable user experiences for registration, sign-in, and profile management, scaling to millions of users while integrating seamlessly with your platform.

Microsoft Entra lifecycle workflows are specifically designed to automate user lifecycle events, including offboarding. These workflows can be configured to automatically disable a user account, remove them from specified groups, and revoke application access immediately upon a termination event, often triggered by changes synced from an HR system. This ensures timely, consistent, and comprehensive removal of access, directly addressing the requirement for efficient and secure offboarding.

App registration in Microsoft Entra ID is the essential process for integrating an application to use Entra ID as its identity provider. By registering an application, administrators define how users authenticate, grant necessary permissions, and configure single sign-on (SSO) protocols like OpenID Connect or SAML. This direct integration enables users to access the registered application seamlessly using their existing Entra ID credentials without re-entering them, thereby providing a unified SSO experience.

Azure AD Application Proxy securely publishes on-premises web applications, making them accessible to remote users without requiring a VPN or inbound firewall rules. It leverages a lightweight connector installed within the corporate network, which establishes an outbound-only connection to the Azure AD Application Proxy service. This allows users to pre-authenticate with Entra ID, apply Conditional Access policies, and then access the internal application via a secure proxy URL, providing single sign-on capabilities.

Device state condition can be set to require a device to be compliant (as defined in Intune) or hybrid Microsoft Entra ID joined. This is the correct condition to enforce access based on device compliance.

Microsoft Entra ID is a comprehensive identity and access management (IAM) solution designed to manage user identities and control their access to various cloud-based applications. It enables organizations to provision users, enforce authentication policies like multi-factor authentication, and authorize access based on roles and groups. This capability is central to securing access to a vast ecosystem of SaaS and custom-developed cloud applications.

Microsoft Entra Self-Service Password Reset (SSPR) is a Microsoft Entra ID feature that empowers users to reset their forgotten or locked passwords without requiring administrator assistance. It significantly reduces helpdesk calls by allowing users to verify their identity through pre-registered authentication methods, such as a mobile app notification, text message, or email to an alternate address. This self-service capability enhances user productivity and can be configured to enforce multi-factor authentication during the reset process for heightened security.

Microsoft Entra ID B2C is specifically engineered for customer identity and access management (CIAM), enabling external customers to sign up and sign in to your custom web and mobile applications. It supports a wide array of identity providers, including social accounts like Google and Facebook, as well as local accounts. B2C provides a highly customizable, branded experience for customer registration, sign-in, and profile management, making it ideal for this scenario.

Configuring Google and Facebook as identity providers in Microsoft Entra ID allows external users to sign in with their existing social accounts. This works with B2B collaboration to enable partners to use social identities for access. It reduces the need for partners to create new credentials and supports the requirement for social identity sign-in.

The Permissions Analytics Report within Microsoft Entra Permissions Management is specifically designed to identify overprivileged identities by analyzing granted permissions against actual usage data over a defined period. This report leverages machine learning to compare an identity's assigned permissions with the specific actions they have performed, highlighting unused, high-risk, or excessive permissions. It provides actionable insights to right-size permissions and enforce the principle of least privilege effectively.

SAML (Security Assertion Markup Language) 2.0 is an XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). Microsoft Entra ID acts as a robust IdP, enabling users to sign in once and gain access to multiple enterprise applications (SPs) without re-entering credentials. This protocol is widely adopted for federated single sign-on with custom line-of-business applications and many SaaS applications, making it a secure, mature, and common solution for integrating enterprise applications with Microsoft Entra ID.

Microsoft Entra Connect is the foundational tool for synchronizing identities between an on-premises Active Directory and Microsoft Entra ID, including critical user account attributes like 'disabled' status. By default, the synchronization cycle runs every 30 minutes, but administrators can configure the Microsoft Entra Connect sync scheduler to run more frequently. This allows for a minimum 5-minute interval, ensuring that time-sensitive changes, such as account disablement, are reflected in the cloud promptly.

Microsoft Entra Access Reviews are specifically designed to manage and automate the periodic review of user access to resources, applications, and roles within Microsoft Entra ID. This feature allows organizations to schedule recurring campaigns where designated reviewers, such as resource owners or managers, certify whether users still require their current permissions. Crucially, Access Reviews can automatically revoke access for users whose permissions are not approved or who fail to respond, directly addressing the compliance requirement for regular access validation and removal of stale assignments.

Microsoft Entra B2B collaboration is the correct solution for enabling secure and seamless collaboration with external partners. It allows organizations to invite guest users from other Microsoft Entra tenants, social identity providers, or email-verified accounts to access applications and resources within their own Microsoft Entra ID. This feature facilitates cross-organizational projects by letting external users utilize their existing credentials without creating new accounts in the host directory, ensuring efficient and governed access.

Microsoft Entra entitlement management is a robust identity governance feature specifically designed to manage the identity and access lifecycle for both internal and external users. It enables organizations to create access packages, which bundle resources like groups, applications, and SharePoint sites, and define policies that include mandatory access reviews and automatic expiration dates for assigned access. This capability directly addresses the requirement for assigning access and enforcing its automatic expiration.

Entitlement Management, a core component of Microsoft Entra Identity Governance, is specifically designed to automate the lifecycle of access for both internal and external users. It allows organizations to define access packages that bundle resources and specify access policies, including start and end dates. When an access package expires, Entitlement Management automatically revokes access and can remove guest accounts from the directory, directly addressing the requirement for automated guest account creation and removal tied to project timelines.

Conditional Access policies, when integrated with Microsoft Entra Identity Protection, can evaluate real-time sign-in risk levels detected by Identity Protection. These policies can then enforce automated actions, such as blocking access, requiring multifactor authentication, or forcing a password change, based on the configured risk thresholds. This provides a robust, automated mechanism to prevent unauthorized access attempts from risky sign-ins.

Microsoft Entra B2B collaboration is the specific feature designed for securely sharing applications and resources with external users from other organizations. It enables partners to use their own corporate or social identities (e.g., Microsoft accounts, Google IDs) to authenticate, rather than requiring them to create new credentials in your tenant. Upon invitation, these partners are represented as guest user objects in your Microsoft Entra ID, allowing for granular access control to specified resources.

Conditional Access policies evaluate various signals, including user, device, location, application, and real-time risk, to make granular access decisions. When a user is blocked from accessing a cloud application due to a Conditional Access policy, the system is designed to provide direct, actionable feedback. This feedback explicitly informs the user *why* access was denied (e.g., 'Your device is not compliant') and often includes clear steps or links to remediate the issue, enabling them to meet the policy requirements and gain access.

Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID is the direct and correct solution for allowing users to reset their own forgotten passwords without requiring administrator assistance. Once SSPR is configured and users have successfully registered their chosen authentication methods (e.g., mobile app, phone, email), they can independently verify their identity and set a new password, significantly improving user experience and reducing help desk workload.

The Microsoft Authenticator app offers a highly effective and cost-efficient solution for passwordless sign-in across a wide range of devices, including iOS, Android, and Windows. It leverages existing smartphone hardware to provide a secure, push-notification-based or number-matching authentication method, eliminating the need for users to type a password. This approach minimizes additional hardware costs, simplifies deployment, and enhances user convenience and security by removing the weakest link in traditional authentication.

This option is incorrect because the device *does* satisfy at least one of the specified conditions. Specifically, the device being Microsoft Entra joined fulfills the 'Domain joined' requirement as interpreted by Conditional Access. Consequently, stating that neither condition is met is a false assessment of the device's state against the policy.

Microsoft Entra ID dynamic groups automatically manage membership based on defined attribute-based rules, such as a user's department or job title. When a user's attributes change, they are automatically added to or removed from the group, ensuring accurate membership. This capability is crucial for automating license assignment through group-based licensing, as licenses are then automatically provisioned or de-provisioned as users join or leave these dynamic groups.

Microsoft Entra federation with SaaS applications is the correct solution because it enables employees to use their existing corporate Microsoft Entra ID credentials for single sign-on (SSO) to third-party Software as a Service (SaaS) applications. This process involves configuring Microsoft Entra ID as the identity provider, allowing it to authenticate users and securely pass identity assertions (e.g., via SAML or OIDC) to the SaaS application, eliminating the need for separate usernames and passwords. This enhances user experience, improves security posture, and centralizes identity management.

Pass-through authentication (PTA) uses a lightweight agent on-premises to validate user credentials directly against Active Directory. When users sign in, their passwords are encrypted and sent to the agent, which verifies them with domain controllers. This meets the requirement of direct validation without storing passwords in the cloud. It provides a seamless experience and is ideal when organizations want to enforce on-premises password policies in real time.

Password Hash Synchronization continuously replicates on-premises password hashes to Microsoft Entra ID, so any password change made in Active Directory is reflected in the cloud within minutes. This directly satisfies the stem's requirement for near-immediate synchronisation of on-premises password changes, without requiring users to authenticate against on-premises infrastructure.

External Identities is the overarching capability within Microsoft Entra ID that enables secure interaction with external users. Specifically, the social identity providers feature allows external users to sign in to your Microsoft Entra ID-protected applications using their existing credentials from popular social accounts like Google, Facebook, LinkedIn, or Amazon. This eliminates the need for external users to create a new account or have an existing Microsoft Entra ID or Microsoft account, streamlining access for a broad range of external collaborators.

Combining both grant controls within one conditional access policy enforces MFA and blocks non-compliant devices at sign-in, matching the untrusted-network and Intune compliance conditions. Both requirements must be satisfied before access is granted, so AND logic is required.

Federation establishes a trust relationship between an identity provider (IdP) and one or more service providers (SPs), enabling users to authenticate once with the IdP and gain access to multiple SPs without re-entering credentials. This mechanism, often leveraging protocols like SAML or OpenID Connect, allows the IdP to assert a user's identity to various applications. It is the core technology that facilitates single sign-on (SSO) across different applications and organizational boundaries.

Conditional Access policies in Microsoft Entra ID provide the precise control needed to enforce requirements based on identity types. By configuring a policy to include the 'Guest or external users' identity type, administrators can specifically mandate multi-factor authentication (MFA) solely for B2B collaboration guests and other external identities. This direct targeting ensures that internal users are not affected, thereby accurately meeting the requirement to enforce MFA exclusively for external users.

Microsoft Entra ID Protection is specifically designed to detect, report, and automatically remediate identity-based risks, such as unusual sign-in locations, impossible travel, and multiple failed sign-in attempts. It leverages machine learning to identify suspicious activities and can configure policies to automatically block access or enforce multi-factor authentication (MFA) when a user's risk level is deemed high. This capability directly addresses the scenario of an account lockout due to multiple failed sign-ins by identifying and responding to the underlying risk.

Microsoft Entra B2B collaboration is the correct solution, enabling organizations to securely share applications and resources with external users from partner companies. It allows these invited guest users to sign in using their existing corporate credentials from their home directory (e.g., another Microsoft Entra tenant, a federated identity provider, or even social identities), eliminating the need for partners to create new accounts in the inviting tenant. This streamlines access while maintaining security and partner identity management.