How Should Contoso Let Fabrikam Developers Use Existing Credentials?

Design authentication and authorization solutions

Answer Correct answer: D — create Azure AD B2B guest accounts in the Contoso tenant so Fabrikam developers sign in with existing credentials and receive the Contributor role.

A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft 365 and an Azure subscription. Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS) and Azure AD Connect. Contoso has a partnership with a company named Fabrikam. Inc. Fabrikam has an Active Directory forest and a Microsoft 365 tenant. Fabrikam has the same on- premises identity infrastructure components as Contoso. A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription. You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources What should you recommend?

In the Azure AD tenant of Contoso. create cloud-only user accounts for the Fabrikam developers.
Configure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.
Configure an organization relationship between the Microsoft 365 tenants of Fabrikam and Contoso.
In the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers. Correct Answer

Community Insight

This item tests external identity for cross-tenant Azure RBAC access — the trap is choosing an on-premises forest trust or a Microsoft 365 organization relationship, neither of which creates an identity that Contoso's Azure AD tenant can grant a role to.

Contoso must give 10 Fabrikam developers the Contributor role on a Contoso resource group while letting them sign in with their existing Fabrikam credentials. The answer is Azure AD B2B collaboration: create guest accounts in the Contoso Azure AD tenant and assign the Azure RBAC role to those guest objects.

The most common wrong pick is A: creating cloud-only user accounts in Contoso, a brand-new credential set that directly violates the 'use their existing credentials' requirement (and adds administrative overhead). B (forest trust) is the second trap, because it addresses on-premises AD DS authentication but does nothing for Azure AD identities or RBAC role assignment.

Community Discussion (24 comments)

Finalflame 👍 1 Selected: D

D, But if you configure C you can sync accounts which automatically create the accounts based on a filter which you can then apply roles too.

Thanveer 👍 2 Selected: D

To ensure that the Fabrikam developers can use their existing credentials to access resources in the Contoso subscription and be assigned the Contributor role, you should create guest accounts for the Fabrikam developers in the Azure AD tenant of Contoso. So, the correct answer is D. In the Azure AD tenant of Contoso, create guest accounts for the Fabrikam developers. This approach leverages Azure AD B2B (Business-to-Business) collaboration, allowing external users to access resources in your Azure AD tenant using their existing credentials. This way, the Fabrikam developers can use their existing credentials to access the resources in the Contoso subscription.

MeisAdriano 👍 2 Selected: D

D. In the Azure AD tenant of Contoso, create guest accounts for the Fabrikam developers. Here's why: Guest accounts in Azure AD (Azure B2B Collaboration): This allows external users (in this case, Fabrikam developers) to access resources in Contoso's Azure AD tenant using their existing credentials. The guest users can then be assigned the necessary roles (e.g., Contributor) to access the resource group.

MeisAdriano 👍 4

Why the other options aren't suitable: A. Create cloud-only user accounts: This would require the Fabrikam developers to manage separate sets of credentials, which is not ideal as it does not meet the requirement of using their existing credentials. B. Configure a forest trust: While this might be a viable solution for on-premises resources, it complicates the cloud environment and doesn’t directly address the requirement of integrating with Azure AD and Microsoft 365. C. Configure an organization relationship between the Microsoft 365 tenants: This can facilitate collaboration features but doesn't grant the granular access control needed to assign specific Azure roles like Contributor. Using guest accounts simplifies access management and ensures that the Fabrikam developers can use their existing credentials securely and efficiently.

23169fd 👍 1 Selected: D

D. In the Azure AD tenant of Contoso, create guest accounts for the Fabrikam developers. Explanation: Azure AD Guest Accounts: B2B Collaboration: Enables inviting users from external organizations (like Fabrikam) as guest users in your Azure AD tenant. Existing Credentials: Fabrikam developers can use their existing credentials to access resources in Contoso's Azure subscription. Role Assignment: You can assign the Contributor role to these guest accounts for the specific resource group.

Toschu 👍 4

FYI: Since 2023 Q3 you would use cross tenant sync: https://learn.microsoft.com/en-us/azure/active-directory/multi-tenant-organizations/cross-tenant-synchronization-overview Users are created as B2B/members instead of member type Guest

Muffay 👍 1

I do not agree, as the question is about 2 seperate organizations. > Who should use? > Organizations that own multiple Microsoft Entra tenants and want to streamline intra-organization cross-tenant application access. > Cross-tenant synchronization is not currently suitable for use across organizational boundaries. Source: https://learn.microsoft.com/en-us/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview#who-should-use

lombri 👍 2 Selected: D

Creating guest accounts, Fabrikam users can use their existing Azure AD credentials to authenticate and access resources in Contoso's subscription. This solution ensures that there is no need for any additional infrastructure, such as a forest trust or organization relationship, between the two companies.

gvh 👍 2

Answer is D Moderator plase verify answer, name is written wrong of the company

NotMeAnyWay 👍 2 Selected: D

D. In the Azure AD tenant of Contoso, create guest accounts for the Fabrikam developers. This solution allows Contoso to assign the necessary role to the Fabrikam developers while ensuring they can use their existing credentials to access resources. By creating guest accounts in Contoso's Azure AD tenant, you can establish a collaboration between the two organizations using Azure AD B2B (Business-to-Business). The guest accounts will enable Fabrikam developers to access the Contoso subscription with their existing credentials, providing a seamless and secure experience for cross-organization collaboration.

cp2323 👍 1 Selected: D

Answer is correct

jameslee 👍 1

compare external identities feature set at : https://learn.microsoft.com/en-us/azure/active-directory/external-identities/external-identities-overview#comparing-external-identities-feature-sets

OPT_001122 👍 1 Selected: D

D. In the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers. ans is correct Thanks to all who have mentioned the exam dates

janvandermerwer 👍 1 Selected: D

D - Devs won't have to change their passwords, using their own user credentials etc

Ghoshy 👍 4

Exam Question 12/28/2022

mellowfella 👍 1 Selected: D

B2B collaboration user objects are typically given a user type of "guest" and can be identified by the #EXT# extension in their user principal name - below drawing in https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

Born_Again 👍 1 Selected: B

Answer is correct: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

ronsav80 👍 2

I think the cleanest answer is Tenant to Tenant Sharing in Azure AD External Identities, but that isn't an option

Elton_Bicalho 👍 1 Selected: C

How can Fabrikam and Contoso enable their people and teams to collaborate more effectively across tenants in a secure manner? Azure Active Directory (Azure AD) B2B collaboration This article describes several key scenarios that Fabrikam and Contoso can consider: https://learn.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-inter-tenant-collaboration?view=o365-worldwide

Snownoodles 👍 7 Selected: D

B2B, use own pasword, guest

Gowind 👍 35 Selected: D

Answer is correct: https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b Collaborate with any partner using their identities With Azure AD B2B, the partner uses their own identity management solution, so there is no external administrative overhead for your organization. Guest users sign in to your apps and services with their own work, school, or social identities. The partner uses their own identities and credentials, whether or not they have an Azure AD account. You don't need to manage external accounts or passwords. You don't need to sync accounts or manage account lifecycles.

sarabjeet22 👍 4

10 users, create guest accounts D

Zstefanovic 👍 1 Selected: C

Find the question a bit vague. assuming the fabrikam tenant is synced to their on-prem AD a B2B connection would be the obvious choice, thus c. If we assume that there is no sync, and there are no AAD idenitities in fabrikam then guest accounts should be created.

Gowind 👍 3

NO C is wrong. Organisational relationship is not used for Azure Ressources: https://docs.microsoft.com/en-us/exchange/sharing/organization-relationships/organization-relationships Set up an organization relationship to share calendar information with an external business partner.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Azure AD B2B collaboration is the designed mechanism for giving external partners access to resources in your tenant with their own credentials. When Contoso creates guest accounts for the Fabrikam developers, each guest object in the Contoso Azure AD tenant is backed by the user's home identity in Fabrikam's Azure AD (federated with Fabrikam's AD DS via Azure AD Connect), so they authenticate with their existing work credentials. The guest user object then becomes a normal security principal in Contoso's directory and can be assigned the Contributor role at the resource group scope. This satisfies both requirements of the question at once: existing credentials and a valid RBAC assignment. As Gowind's linked Microsoft article puts it, "the partner uses their own identity management solution, so there is no external administrative overhead for your organization."

Why the Other Options Are Wrong

A is wrong because cloud-only accounts create a second, unrelated credential set that the Fabrikam developers would have to manage — the exact opposite of the stated requirement. B is wrong because an AD DS forest trust only affects on-premises Kerberos/NTLM authentication; Azure RBAC requires the identity to exist in the Contoso Azure AD tenant, and a forest trust does not project Fabrikam users into that tenant. C is wrong because an organization relationship between Microsoft 365 tenants is an Exchange Online construct used for cross-tenant free/busy and calendar sharing, as Gowind pointed out — it grants no access to Azure resources or role assignments. That leaves D as the only option that produces an assignable identity in the correct directory.

Community Comment Notes

Consensus is overwhelming: Gowind, Snownoodles, Thanveer, sarabjeet22, MeisAdriano and lombri all select D, with Snownoodles summarizing it as "B2B, use own pasword, guest" and sarabjeet22 simply noting "10 users, create guest accounts D". Gowind also correctly disqualifies C, citing Microsoft's organization-relationship documentation for the fact that it only shares calendar information with an external business partner. MeisAdriano walks through A/B/C rejection using the existing-credentials requirement, which mirrors the reasoning above. Toschu adds a worthwhile modern footnote: since late 2023 you could alternatively use cross-tenant synchronization, which creates B2B collaboration users (member or guest type) — but the exam scenario is still answered by guest accounts.

Official Reference

Exam Strategy

When a scenario says external partner users must use their existing credentials for Azure resources, immediately map that to Azure AD B2B guest accounts — role assignment in Azure always requires a principal in the tenant that owns the subscription. Eliminate on-premises trust options (they never create an Azure AD identity) and Microsoft 365 sharing options (they never grant Azure RBAC access) before you evaluate user-provisioning choices.

Frequently Asked Questions

Why is a forest trust between Contoso and Fabrikam AD DS not enough here?

A forest trust only enables on-premises Kerberos authentication. Azure RBAC requires a user object in the Contoso Azure AD tenant, and a forest trust does not create one.

Can Contoso guest accounts be assigned Azure RBAC roles?

Yes. Once the Fabrikam developers exist as guest users in the Contoso tenant, they can be assigned Contributor on the resource group just like any other security principal.

More AZ-305 FAQ →

Related Analysis

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide