Guest users and External Identities
Collaborating with partners is a daily admin task, and SC-300 tests how guests are created, limited and governed.
B2B guests
A guest user has userType = Guest and signs in with their home identity (another Entra tenant, a Microsoft account, Google, or an email one-time passcode). You create one by sending an invitation from the Entra admin center or with New-MgInvitation. The guest becomes active on redeeming the invitation. Creating a normal cloud user with an external address is not the same thing.
Guests can be added to groups, assigned to apps, and included in access packages and access reviews.
Settings that control guests
| Setting | What it controls |
|---|---|
| External collaboration settings | Who can invite, guest access level, collaboration restrictions (allow or deny domains) |
| Cross-tenant access settings | Inbound and outbound B2B collaboration and B2B direct connect per organization |
| Inbound trust | Accept MFA, compliant device and hybrid joined claims from partners |
| Cross-tenant synchronization | Automatic provisioning of users between tenants |
Default guest access is limited: guests see only limited directory properties. The most restrictive level also hides other users’ details.
Self-service sign-up
User flows let external users sign up for apps themselves, with the identity providers you choose. Use this when you cannot invite each person.
Cross-tenant synchronization
You configure it in the source tenant, with a configuration, attribute mappings, and scoping to users and groups. The target tenant must allow inbound sync. Users appear as members or guests depending on the userType mapping.
Lifecycle
Guests should not live forever. Use access reviews or entitlement management with expiration to remove inactive guests.
Exam traps
- Collaboration restrictions use an allow list or a deny list, not both.
- Inviting needs the Guest Inviter role or a setting that lets members invite; it is not a Global Administrator-only task.
- Inbound trust applies to the tenant being accessed, so you configure it in the resource tenant.
- B2B guests use their own credentials; you do not manage their password.
- Cross-tenant sync is source-driven: you configure it where the users come from.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A contractor uses their own work email address and must sign in with it to access App1 in your tenant. What do you create?
Show answer
Answer: B.A B2B guest user signs in with their own credentials from their home identity provider.
2. Only members of a specific group should be allowed to invite guests. Where do you configure who can invite?
Show answer
Answer: A.External collaboration settings control who can invite guests and the guest access level.
3. Contoso wants users from Fabrikam's tenant to be created in Contoso automatically, without invitations. What do you use?
Show answer
Answer: A.Cross-tenant synchronization automates creating and updating B2B users across tenants.
4. You want to trust MFA already completed in a partner tenant so guests are not prompted twice. What do you configure?
Show answer
Answer: A.In cross-tenant access settings, inbound trust can accept MFA claims from the partner tenant.