Microsoft SC-300 Bundle

The distinct mechanism for Set external collaboration domain restrictions and invitation permissions appropriately is that external collaboration controls can restrict who may invite and which domains may receive invitations; this handles procurement staff should be unable to invite guests from an unapproved external email domain rather than external guests must sign in using an approved federation provider rather than a new local account, so use Configure the supported external identity provider and redemption order for the collaboration scenario.

Although Review the guest lifecycle and remove or disable residual resource-tenant entitlements fits a guest's home account was disabled but the resource tenant still shows an old guest object (external account lifecycle does not excuse leaving stale application assignments in the resource tenant), it is not the necessary control for external guests must sign in using an approved federation provider rather than a new local account. Select Configure the supported external identity provider and redemption order for the collaboration scenario.

Configure partner-specific cross-tenant access settings rather than changing every external tenant globally would support the different situation where the organization wants an explicit policy for which suppliers can collaborate with employees: organizational overrides allow narrower partner trust while preserving reasonable default external access; however it does not resolve external guests must sign in using an approved federation provider rather than a new local account, which calls for Configure the supported external identity provider and redemption order for the collaboration scenario.

Although Configure supported guest user access restrictions and appropriate application permissions fits external users should see limited directory information rather than internal membership details (guest directory visibility and application authorization are separate security decisions), it is not the necessary control for new internal employees in the source tenant should automatically appear as B2B identities in the target tenant. Select Configure supported cross-tenant synchronization from source to target with the required target inbound permissions.

Include the employee in governed cross-tenant sync lifecycle and confirm delete/disable behavior would support the different situation where the source employee leaves the organization and the target B2B identity should be deprovisioned: automated provisioning can propagate source-object lifecycle to the target instead of retaining an unmanaged guest; however it does not resolve new internal employees in the source tenant should automatically appear as B2B identities in the target tenant, which calls for Configure supported cross-tenant synchronization from source to target with the required target inbound permissions.

Invitation permissions minimize uncontrolled guest proliferation and unintended external directory access, which makes Restrict guest invitation authority to appropriately designated roles or members appropriate when a local administrator wants anyone to invite external users without regard to source; here the task is new internal employees in the source tenant should automatically appear as B2B identities in the target tenant, requiring Configure supported cross-tenant synchronization from source to target with the required target inbound permissions.

Invitation permissions minimize uncontrolled guest proliferation and unintended external directory access, which makes Restrict guest invitation authority to appropriately designated roles or members appropriate when a local administrator wants anyone to invite external users without regard to source; here the task is a subsidiary expects the target tenant to pull every user in the source without source authorization, requiring Configure users and mapping scope in the source tenant and inbound sync acceptance in the target.

When a partner's device-compliance assertion is being trusted without formal authorization, Disable unapproved external device-claim trust and restrict partner settings is justified because trusted-claim configuration changes the evidence local policy accepts and requires security review; here the issue is a subsidiary expects the target tenant to pull every user in the source without source authorization, and Configure users and mapping scope in the source tenant and inbound sync acceptance in the target addresses that distinction.

Configure supported automatic redemption settings on the appropriate source and target sides concerns users complain about repeated invitation redemption dialogs in a tightly approved bilateral setup, where automatic redemption reduces guest acceptance prompts without granting new application entitlements; the current scenario instead requires a subsidiary expects the target tenant to pull every user in the source without source authorization, so Configure users and mapping scope in the source tenant and inbound sync acceptance in the target is a closer fit.

Automated provisioning can propagate source-object lifecycle to the target instead of retaining an unmanaged guest, which makes Include the employee in governed cross-tenant sync lifecycle and confirm delete/disable behavior appropriate when the source employee leaves the organization and the target B2B identity should be deprovisioned; here the task is existing manual guest invitations must continue working when automated synchronization is introduced, requiring Keep B2B collaboration policies distinct from target cross-tenant sync inbound settings.

When approved cross-tenant synchronization does not create the expected target guest objects, Check source provisioning scope and mapping alongside target inbound synchronization permission is justified because the source selects and pushes eligible objects while the target must permit the inbound synchronization; here the issue is existing manual guest invitations must continue working when automated synchronization is introduced, and Keep B2B collaboration policies distinct from target cross-tenant sync inbound settings addresses that distinction.

The distinct mechanism for Validate supported matching and existing B2B identity behavior rather than issuing a second guest manually is that cross-tenant synchronization can match supported existing B2B objects, avoiding duplicate directory identities; this handles an external user was already invited before automated provisioning was configured rather than existing manual guest invitations must continue working when automated synchronization is introduced, so use Keep B2B collaboration policies distinct from target cross-tenant sync inbound settings.

When existing manual guest invitations must continue working when automated synchronization is introduced, Keep B2B collaboration policies distinct from target cross-tenant sync inbound settings is justified because target sync permission does not by itself control manual invitation-based B2B collaboration; here the issue is the source employee leaves the organization and the target B2B identity should be deprovisioned, and Include the employee in governed cross-tenant sync lifecycle and confirm delete/disable behavior addresses that distinction.

Configure supported cross-tenant synchronization from source to target with the required target inbound permissions concerns new internal employees in the source tenant should automatically appear as B2B identities in the target tenant, where cross-tenant synchronization pushes scoped internal source users through Entra provisioning instead of manual guest invites; the current scenario instead requires the source employee leaves the organization and the target B2B identity should be deprovisioned, so Include the employee in governed cross-tenant sync lifecycle and confirm delete/disable behavior is a closer fit.

The distinct mechanism for Configure partner-specific cross-tenant access settings rather than changing every external tenant globally is that organizational overrides allow narrower partner trust while preserving reasonable default external access; this handles the organization wants an explicit policy for which suppliers can collaborate with employees rather than the source employee leaves the organization and the target B2B identity should be deprovisioned, so use Include the employee in governed cross-tenant sync lifecycle and confirm delete/disable behavior.

Configure supported guest user access restrictions and appropriate application permissions concerns external users should see limited directory information rather than internal membership details, where guest directory visibility and application authorization are separate security decisions; the current scenario instead requires the organization wants an explicit policy for which suppliers can collaborate with employees, so Configure partner-specific cross-tenant access settings rather than changing every external tenant globally is a closer fit.

The distinct mechanism for Enable explicit inbound device-claim trust for the verified external organization is that external device trust is opt-in and still relies on local Conditional Access rules evaluating the claim; this handles the resource tenant wants to trust a partner device-compliance claim for specific Conditional Access flows rather than the organization wants an explicit policy for which suppliers can collaborate with employees, so use Configure partner-specific cross-tenant access settings rather than changing every external tenant globally.

Although Review external collaboration settings and the applicable fallback identity provider fits a consumer email guest is unexpectedly blocked when only Entra partner trust was configured (consumer or non-Entra guest redemption uses external collaboration controls in addition to partner cross-tenant settings), it is not the necessary control for the organization wants an explicit policy for which suppliers can collaborate with employees. Select Configure partner-specific cross-tenant access settings rather than changing every external tenant globally.

The distinct mechanism for Restrict B2B inbound trust to the partner tenant's chosen users, groups and application is that a scoped cross-tenant policy avoids accepting every identity or resource request from that organization; this handles only a designated partner division should access a jointly developed SaaS application rather than a consumer email guest is unexpectedly blocked when only Entra partner trust was configured, so use Review external collaboration settings and the applicable fallback identity provider.

Add an organization-specific outbound or inbound block override for that tenant would support the different situation where one company should be blocked while other partner tenants retain the default policy: organization-level cross-tenant settings can override the defaults for just one external organization; however it does not resolve a consumer email guest is unexpectedly blocked when only Entra partner trust was configured, which calls for Review external collaboration settings and the applicable fallback identity provider.

Guest directory visibility and application authorization are separate security decisions, which makes Configure supported guest user access restrictions and appropriate application permissions appropriate when external users should see limited directory information rather than internal membership details; here the task is a consumer email guest is unexpectedly blocked when only Entra partner trust was configured, requiring Review external collaboration settings and the applicable fallback identity provider.

Although Restrict guest invitation authority to appropriately designated roles or members fits a local administrator wants anyone to invite external users without regard to source (invitation permissions minimize uncontrolled guest proliferation and unintended external directory access), it is not the necessary control for external users should see limited directory information rather than internal membership details. Select Configure supported guest user access restrictions and appropriate application permissions.

Configure partner-specific cross-tenant access settings rather than changing every external tenant globally would support the different situation where the organization wants an explicit policy for which suppliers can collaborate with employees: organizational overrides allow narrower partner trust while preserving reasonable default external access; however it does not resolve external users should see limited directory information rather than internal membership details, which calls for Configure supported guest user access restrictions and appropriate application permissions.

When an external user was already invited before automated provisioning was configured, Validate supported matching and existing B2B identity behavior rather than issuing a second guest manually is justified because cross-tenant synchronization can match supported existing B2B objects, avoiding duplicate directory identities; here the issue is external users should see limited directory information rather than internal membership details, and Configure supported guest user access restrictions and appropriate application permissions addresses that distinction.

Scope allowed B2B collaboration settings by organization and target application would support the different situation where only suppliers from two named partner tenants should receive inbound access: external tenant identity alone should not grant blanket access to all agency services; however it does not resolve a contractor with a valid invitation still cannot open the application, which calls for Check inbound external access, Conditional Access, and enterprise application assignment.

Organizational overrides allow narrower partner trust while preserving reasonable default external access, which makes Configure partner-specific cross-tenant access settings rather than changing every external tenant globally appropriate when the organization wants an explicit policy for which suppliers can collaborate with employees; here the task is a contractor with a valid invitation still cannot open the application, requiring Check inbound external access, Conditional Access, and enterprise application assignment.

When a guest's home account was disabled but the resource tenant still shows an old guest object, Review the guest lifecycle and remove or disable residual resource-tenant entitlements is justified because external account lifecycle does not excuse leaving stale application assignments in the resource tenant; here the issue is a contractor with a valid invitation still cannot open the application, and Check inbound external access, Conditional Access, and enterprise application assignment addresses that distinction.

Automatic redemption reduces guest acceptance prompts without granting new application entitlements, which makes Configure supported automatic redemption settings on the appropriate source and target sides appropriate when users complain about repeated invitation redemption dialogs in a tightly approved bilateral setup; here the task is only a designated partner division should access a jointly developed SaaS application, requiring Restrict B2B inbound trust to the partner tenant's chosen users, groups and application.

When one company should be blocked while other partner tenants retain the default policy, Add an organization-specific outbound or inbound block override for that tenant is justified because organization-level cross-tenant settings can override the defaults for just one external organization; here the issue is only a designated partner division should access a jointly developed SaaS application, and Restrict B2B inbound trust to the partner tenant's chosen users, groups and application addresses that distinction.

Review external collaboration settings and the applicable fallback identity provider concerns a consumer email guest is unexpectedly blocked when only Entra partner trust was configured, where consumer or non-Entra guest redemption uses external collaboration controls in addition to partner cross-tenant settings; the current scenario instead requires only a designated partner division should access a jointly developed SaaS application, so Restrict B2B inbound trust to the partner tenant's chosen users, groups and application is a closer fit.

Enable explicit inbound device-claim trust for the verified external organization concerns the resource tenant wants to trust a partner device-compliance claim for specific Conditional Access flows, where external device trust is opt-in and still relies on local Conditional Access rules evaluating the claim; the current scenario instead requires the partner's admin proposes enabling reciprocal direct connect although only standard app invitations are needed, so Use B2B collaboration without enabling direct connect for this ordinary guest application is a closer fit.

The distinct mechanism for Configure approved inbound cross-tenant trust settings for MFA claims from the partner is that mFA claim trust can avoid a second challenge while still applying local Conditional Access policies; this handles security wants to rely on the partner's completed MFA only when explicitly trusted rather than the partner's admin proposes enabling reciprocal direct connect although only standard app invitations are needed, so use Use B2B collaboration without enabling direct connect for this ordinary guest application.

Although Review cross-cloud collaboration support and use a permitted B2B model instead of assuming direct connect works fits a planned B2B direct connect relationship spans unsupported Microsoft cloud boundaries (microsoft documents limits for direct connect between different Microsoft cloud environments), it is not the necessary control for the partner's admin proposes enabling reciprocal direct connect although only standard app invitations are needed. Select Use B2B collaboration without enabling direct connect for this ordinary guest application.