How to Limit Entra Guest Invitations to fabrikam.com?
You have a Microsoft Entra tenant named contoso.com. You collaborate with an external partner named fabrikam.com. You plan to invite users in fabrikam.com to the contoso.com tenant. You need to ensure that invitations can be sent only to fabrikam.com users. What should you do in the Microsoft Entra admin center?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests invitation-domain scoping versus post-invitation guest permissions, and the trap is confusing Collaboration restrictions with Cross-tenant access settings.
This AZ-104 scenario asks how to ensure Microsoft Entra B2B invitations go only to fabrikam.com users. The answer is External collaboration settings > Collaboration restrictions, where you allow invitations only to the specified partner domain.
Many candidates pick Cross-tenant access settings because the words tenant and external appear, but tenant restrictions control resource access across tenants, not which domains can receive guest invitations.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Collaboration restrictions live under External collaboration settings in the Microsoft Entra admin center and are the supported control for scoping B2B guest invitations to specific domains. Selecting "Allow invitations only to the specified domains" and adding fabrikam.com means any attempt to invite a user whose domain is not fabrikam.com is blocked, exactly matching the requirement. This setting applies to invitation creation, which is what the question asks about, rather than to what guest users can do after they join. KAM2023 captured this precisely: the setting is "specifically designed to control which external domains can be invited as guests."Why the Other Options Are Wrong
Option A, Tenant restrictions in Cross-tenant access settings, controls whether your users can reach applications and resources in other tenants, not who can be invited into contoso.com. Option B, Microsoft cloud settings in Cross-tenant access settings, is used to enable B2B collaboration with users in other Microsoft clouds such as Azure Government or Azure China. Option C, Guest user access restrictions, decides the level of directory access guests receive after they are invited; it has no domain-allowlist capability. minura made the same distinction, explaining that "they manage access to resources between tenants" rather than guest invitations.Community Comment Notes
The comment thread is unanimous for D, which aligns with the documented feature behavior. KAM2023 emphasized that Collaboration restrictions are the domain-scoping control, and Shakka walked through the exact navigation: Identity > External Identities > External collaboration settings > Collaboration restrictions. adilkhan's memory hook, "keywords to remember collaborate, external", points directly to the correct blade. chrillelundmark linked the Microsoft Learn external collaboration settings page, which documents this configuration. Even though the votes are one-sided, the reasoning in the comments matches the exam doctrine, so the source key is defensible here.Official Reference
Exam Strategy
Memorize the External Identities blade split: External collaboration settings govern invitations and guest permissions, while Cross-tenant access settings govern inbound and outbound tenant trust and resource access. If the requirement mentions who can be invited, choose Collaboration restrictions.
Frequently Asked Questions
Why is Cross-tenant access settings wrong for limiting guest invitations?
Tenant restrictions and Microsoft cloud settings in Cross-tenant access control resource access or B2B with other Microsoft clouds, not the domains that can receive guest invitations.
What exactly does Collaboration restrictions do?
It lets you allow or deny B2B invitations by domain; selecting 'Allow invitations only to the specified domains' and adding fabrikam.com enforces the requirement.
Related Analysis
Practice All AZ-104 Questions
Access 100 questions with complete answers and detailed explanations.
View Full AZ-104 Practice Test →