Manage Microsoft Entra users and groups

Harbor Point Shipping has a Microsoft Entra ID tenant in which any member user can currently invite guests. A security review requires that only users holding the Guest Inviter or User Administrator role can invite guests, and that guests can be invited only from the partner domain northstar-freight.example. The security team must implement both requirements without affecting existing guest accounts.

Which two actions should you perform? Each correct answer presents part of the solution.

1. AIn External collaboration settings, set Guest invite settings to allow only users assigned to specific admin roles to invite guests.This setting limits invitation rights to administrators in roles such as Guest Inviter and User Administrator and removes the ability of ordinary members to invite.
2. BIn External collaboration settings, configure Collaboration restrictions to allow invitations only to the specified domain northstar-freight.example.The collaboration restrictions allowlist limits new invitations to the listed domains while leaving existing guest users untouched.
3. CDelete all existing guest users and re-invite them under the new policy.The scenario explicitly requires no impact on existing guests. The settings are forward-looking and do not require re-inviting anyone.
4. DCreate a Conditional Access policy that blocks sign-in for all guest users.Blocking guest sign-in would prevent existing guests from working and does not control who can send invitations or from which domains.
5. ESet Guest user access restrictions to the most restrictive level so guests cannot read other users or groups.Guest user access restrictions control what guests can see in the directory after they are in, not who may invite them or which domains are allowed.

Ravenstone Media enabled SSPR for all users last week. The security policy states that a user must prove possession of two different verification methods before a reset is allowed, and the help desk reports that many users have never registered any method. The IT manager wants users to be prompted to register the next time they sign in, without changing the number of methods required for reset.

Which pair of SSPR settings meets both requirements?

1. ASet Number of methods required to reset to 2, and set Require users to register when signing in to Yes.Number of methods required to reset enforces the two-method policy, and the registration setting prompts unregistered users to provide methods at their next interactive sign-in.
2. BSet Number of methods required to reset to 1, and enable Notify users on password resets.One method violates the two-method policy, and the notification setting only emails users after a reset; it does not drive registration.
3. CSet Self service password reset enabled to None until every user has registered methods manually.Disabling SSPR removes the capability for everyone and does nothing to prompt users to register.
4. DSet Number of methods required to reset to 2, and set Number of days before users are asked to reconfirm their authentication information to 0.Setting the reconfirmation interval to 0 disables reconfirmation prompts entirely; it does not force initial registration.

Quillfield Education has 900 users in a Microsoft Entra ID tenant. The help desk wants to pilot self-service password reset with only the 40 members of the security group GRP-SSPR-Pilot before rolling it out to everyone. No other users should be able to use SSPR during the pilot.

How should you configure the SSPR Self service password reset enabled setting?

1. ASet it to All.All enables SSPR for every user in the tenant, which exceeds the pilot scope.
2. BSet it to Selected and choose GRP-SSPR-Pilot.Selected scopes SSPR to the members of a single chosen group, which is exactly the pilot pattern Microsoft recommends.
3. CSet it to None and ask pilot users to call the help desk.None disables SSPR for everyone, so the pilot group could not test the feature at all.
4. DSet it to All and create a Conditional Access policy that blocks the password reset portal for users outside the pilot group.This is a complicated workaround; the SSPR blade already has a Selected option that scopes enablement to one group without any Conditional Access policy.

Marigold Studios needs to give an auditor from an external accounting firm, j.okafor@ledgerfirm.example, read access to a resource group named RG-Finance in the Marigold Azure subscription. The auditor must sign in with her existing work credentials from her own organization, and Marigold must not create or manage a password for her.

What should you do first?

1. ACreate a new member user named j.okafor in the Marigold tenant with a temporary password.A member user is a separate identity with a Marigold-managed password, which violates the requirement that she use her own credentials and that Marigold not manage a password.
2. BInvite j.okafor@ledgerfirm.example as a guest user in Microsoft Entra ID, then assign the Reader role on RG-Finance to the guest.Microsoft Entra B2B collaboration creates a guest object that authenticates against the auditor's home tenant, and the guest can then receive an Azure role assignment like any other principal.
3. CConfigure Microsoft Entra Connect to synchronize the accounting firm's directory into the Marigold tenant.Entra Connect synchronizes an on-premises Active Directory that Marigold owns. It cannot synchronize another organization's directory.
4. DCreate a shared access signature for the resources in RG-Finance and email it to the auditor.SAS tokens apply to Azure Storage data operations, not to Azure Resource Manager access on a resource group, and they do not involve her identity at all.