Microsoft SC-300 Bundle

Use B2B guest identities with explicitly scoped directory role grants where supported would support the different situation where security wants partner administrators to use B2B privileges without being created as ordinary local employees: external collaboration identity type and tenant-local role authorization should remain deliberately governed; however it does not resolve one company should be blocked while other partner tenants retain the default policy, which calls for Add an organization-specific outbound or inbound block override for that tenant.

The source provisioning service does not support arbitrarily pushing existing external identities as internal employees, which makes Configure cross-tenant synchronization for eligible internal source accounts only appropriate when acquired subsidiaries need automated visibility of employee changes but not synchronization of external guests from the source; here the task is one company should be blocked while other partner tenants retain the default policy, requiring Add an organization-specific outbound or inbound block override for that tenant.

When a consumer email guest is unexpectedly blocked when only Entra partner trust was configured, Review external collaboration settings and the applicable fallback identity provider is justified because consumer or non-Entra guest redemption uses external collaboration controls in addition to partner cross-tenant settings; here the issue is one company should be blocked while other partner tenants retain the default policy, and Add an organization-specific outbound or inbound block override for that tenant addresses that distinction.

Trusted-claim configuration changes the evidence local policy accepts and requires security review, which makes Disable unapproved external device-claim trust and restrict partner settings appropriate when a partner's device-compliance assertion is being trusted without formal authorization; here the task is a planned B2B direct connect relationship spans unsupported Microsoft cloud boundaries, requiring Review cross-cloud collaboration support and use a permitted B2B model instead of assuming direct connect works.

When the company wants one audit view for partner cross-tenant access policy edits, Filter Entra directory audit events for cross-tenant access settings changes is justified because audit log categories expose configuration modifications more reliably than current policy screenshots; here the issue is a planned B2B direct connect relationship spans unsupported Microsoft cloud boundaries, and Review cross-cloud collaboration support and use a permitted B2B model instead of assuming direct connect works addresses that distinction.

Use B2B collaboration without enabling direct connect for this ordinary guest application concerns the partner's admin proposes enabling reciprocal direct connect although only standard app invitations are needed, where direct connect is a separate trust mode and should not be enabled without a supported use case; the current scenario instead requires a planned B2B direct connect relationship spans unsupported Microsoft cloud boundaries, so Review cross-cloud collaboration support and use a permitted B2B model instead of assuming direct connect works is a closer fit.

When the company wants one audit view for partner cross-tenant access policy edits, Filter Entra directory audit events for cross-tenant access settings changes is justified because audit log categories expose configuration modifications more reliably than current policy screenshots; here the issue is guest users cannot complete identity redemption when their fallback account provider was disabled, and Keep a supported fallback identity provider configured in external collaboration redemption order addresses that distinction.

The distinct mechanism for Review redemption state and reset guest redemption where the scenario requires is that guest redemption is bound to authentication identity and can require controlled reset after provider changes; this handles a student guest has trouble redeeming an invitation after changing their identity provider rather than guest users cannot complete identity redemption when their fallback account provider was disabled, so use Keep a supported fallback identity provider configured in external collaboration redemption order.

Although Review cross-cloud collaboration support and use a permitted B2B model instead of assuming direct connect works fits a planned B2B direct connect relationship spans unsupported Microsoft cloud boundaries (microsoft documents limits for direct connect between different Microsoft cloud environments), it is not the necessary control for guest users cannot complete identity redemption when their fallback account provider was disabled. Select Keep a supported fallback identity provider configured in external collaboration redemption order.

Use B2B guest identities with explicitly scoped directory role grants where supported concerns security wants partner administrators to use B2B privileges without being created as ordinary local employees, where external collaboration identity type and tenant-local role authorization should remain deliberately governed; the current scenario instead requires a partner's device-compliance assertion is being trusted without formal authorization, so Disable unapproved external device-claim trust and restrict partner settings is a closer fit.

Although Keep a supported fallback identity provider configured in external collaboration redemption order fits guest users cannot complete identity redemption when their fallback account provider was disabled (guest invitation redemption needs at least one supported fallback identity provider), it is not the necessary control for a partner's device-compliance assertion is being trusted without formal authorization. Select Disable unapproved external device-claim trust and restrict partner settings.

Review cross-cloud collaboration support and use a permitted B2B model instead of assuming direct connect works would support the different situation where a planned B2B direct connect relationship spans unsupported Microsoft cloud boundaries: microsoft documents limits for direct connect between different Microsoft cloud environments; however it does not resolve a partner's device-compliance assertion is being trusted without formal authorization, which calls for Disable unapproved external device-claim trust and restrict partner settings.

The distinct mechanism for Use B2B guest identities with explicitly scoped directory role grants where supported is that external collaboration identity type and tenant-local role authorization should remain deliberately governed; this handles security wants partner administrators to use B2B privileges without being created as ordinary local employees rather than the company wants one audit view for partner cross-tenant access policy edits, so use Filter Entra directory audit events for cross-tenant access settings changes.

Although Keep a supported fallback identity provider configured in external collaboration redemption order fits guest users cannot complete identity redemption when their fallback account provider was disabled (guest invitation redemption needs at least one supported fallback identity provider), it is not the necessary control for the company wants one audit view for partner cross-tenant access policy edits. Select Filter Entra directory audit events for cross-tenant access settings changes.

Disable unapproved external device-claim trust and restrict partner settings would support the different situation where a partner's device-compliance assertion is being trusted without formal authorization: trusted-claim configuration changes the evidence local policy accepts and requires security review; however it does not resolve the company wants one audit view for partner cross-tenant access policy edits, which calls for Filter Entra directory audit events for cross-tenant access settings changes.

Although Restrict B2B inbound trust to the partner tenant's chosen users, groups and application fits only a designated partner division should access a jointly developed SaaS application (a scoped cross-tenant policy avoids accepting every identity or resource request from that organization), it is not the necessary control for only suppliers from two named partner tenants should receive inbound access. Select Scope allowed B2B collaboration settings by organization and target application.

Diagnose cross-tenant MFA trust plus the resource Conditional Access evaluation would support the different situation where an external user signs in successfully but violates the required resource-tenant MFA policy: a home-tenant challenge is not automatically accepted unless configured to satisfy local requirements; however it does not resolve only suppliers from two named partner tenants should receive inbound access, which calls for Scope allowed B2B collaboration settings by organization and target application.

When employees should be prevented from establishing new connections to a suspicious supplier's tenant, Configure an outbound cross-tenant block for that organization as part of the incident control is justified because outbound restriction governs internal users' access to resources hosted by the external organization; here the issue is only suppliers from two named partner tenants should receive inbound access, and Scope allowed B2B collaboration settings by organization and target application addresses that distinction.

Scope allowed B2B collaboration settings by organization and target application would support the different situation where only suppliers from two named partner tenants should receive inbound access: external tenant identity alone should not grant blanket access to all agency services; however it does not resolve an external user signs in successfully but violates the required resource-tenant MFA policy, which calls for Diagnose cross-tenant MFA trust plus the resource Conditional Access evaluation.

Blocking the vendor's outbound traffic alone is not a complete tenant-local entitlement cleanup, which makes Revoke resource-tenant app assignments and remove or disable the related B2B guests appropriate when contractor accounts from a terminated supplier must lose purchasing portal authorization; here the task is an external user signs in successfully but violates the required resource-tenant MFA policy, requiring Diagnose cross-tenant MFA trust plus the resource Conditional Access evaluation.

When the resource tenant wants to trust a partner device-compliance claim for specific Conditional Access flows, Enable explicit inbound device-claim trust for the verified external organization is justified because external device trust is opt-in and still relies on local Conditional Access rules evaluating the claim; here the issue is an external user signs in successfully but violates the required resource-tenant MFA policy, and Diagnose cross-tenant MFA trust plus the resource Conditional Access evaluation addresses that distinction.

A home-tenant challenge is not automatically accepted unless configured to satisfy local requirements, which makes Diagnose cross-tenant MFA trust plus the resource Conditional Access evaluation appropriate when an external user signs in successfully but violates the required resource-tenant MFA policy; here the task is contractor accounts from a terminated supplier must lose purchasing portal authorization, requiring Revoke resource-tenant app assignments and remove or disable the related B2B guests.

When a contractor with a valid invitation still cannot open the application, Check inbound external access, Conditional Access, and enterprise application assignment is justified because a valid guest object is not sufficient if app assignment or resource-tenant policy prevents access; here the issue is contractor accounts from a terminated supplier must lose purchasing portal authorization, and Revoke resource-tenant app assignments and remove or disable the related B2B guests addresses that distinction.

The distinct mechanism for Configure an outbound cross-tenant block for that organization as part of the incident control is that outbound restriction governs internal users' access to resources hosted by the external organization; this handles employees should be prevented from establishing new connections to a suspicious supplier's tenant rather than contractor accounts from a terminated supplier must lose purchasing portal authorization, so use Revoke resource-tenant app assignments and remove or disable the related B2B guests.

Use B2B guest identities with explicitly scoped directory role grants where supported concerns security wants partner administrators to use B2B privileges without being created as ordinary local employees, where external collaboration identity type and tenant-local role authorization should remain deliberately governed; the current scenario instead requires employees should be prevented from establishing new connections to a suspicious supplier's tenant, so Configure an outbound cross-tenant block for that organization as part of the incident control is a closer fit.

The distinct mechanism for Scope allowed B2B collaboration settings by organization and target application is that external tenant identity alone should not grant blanket access to all agency services; this handles only suppliers from two named partner tenants should receive inbound access rather than employees should be prevented from establishing new connections to a suspicious supplier's tenant, so use Configure an outbound cross-tenant block for that organization as part of the incident control.

Although Revoke resource-tenant app assignments and remove or disable the related B2B guests fits contractor accounts from a terminated supplier must lose purchasing portal authorization (blocking the vendor's outbound traffic alone is not a complete tenant-local entitlement cleanup), it is not the necessary control for employees should be prevented from establishing new connections to a suspicious supplier's tenant. Select Configure an outbound cross-tenant block for that organization as part of the incident control.

Keep a supported fallback identity provider configured in external collaboration redemption order concerns guest users cannot complete identity redemption when their fallback account provider was disabled, where guest invitation redemption needs at least one supported fallback identity provider; the current scenario instead requires the nonprofit wants external workers to keep authenticating in their home Entra tenant, so Use B2B collaboration while authorizing their resource-tenant app access is a closer fit.

The distinct mechanism for Review the organization-specific MFA trust options and disable the unintended inbound trust is that cross-tenant claim trust determines whether external authentications can satisfy resource-tenant policies; this handles a resource tenant accidentally accepted MFA claims from an unapproved organization rather than the nonprofit wants external workers to keep authenticating in their home Entra tenant, so use Use B2B collaboration while authorizing their resource-tenant app access.

Although Check source provisioning scope and mapping alongside target inbound synchronization permission fits approved cross-tenant synchronization does not create the expected target guest objects (the source selects and pushes eligible objects while the target must permit the inbound synchronization), it is not the necessary control for the nonprofit wants external workers to keep authenticating in their home Entra tenant. Select Use B2B collaboration while authorizing their resource-tenant app access.

The distinct mechanism for Validate supported matching and existing B2B identity behavior rather than issuing a second guest manually is that cross-tenant synchronization can match supported existing B2B objects, avoiding duplicate directory identities; this handles an external user was already invited before automated provisioning was configured rather than approved cross-tenant synchronization does not create the expected target guest objects, so use Check source provisioning scope and mapping alongside target inbound synchronization permission.

Although Review the organization-specific MFA trust options and disable the unintended inbound trust fits a resource tenant accidentally accepted MFA claims from an unapproved organization (cross-tenant claim trust determines whether external authentications can satisfy resource-tenant policies), it is not the necessary control for approved cross-tenant synchronization does not create the expected target guest objects. Select Check source provisioning scope and mapping alongside target inbound synchronization permission.

Keep B2B collaboration policies distinct from target cross-tenant sync inbound settings would support the different situation where existing manual guest invitations must continue working when automated synchronization is introduced: target sync permission does not by itself control manual invitation-based B2B collaboration; however it does not resolve approved cross-tenant synchronization does not create the expected target guest objects, which calls for Check source provisioning scope and mapping alongside target inbound synchronization permission.