How Does Microsoft Entra Govern Fabrikam B2B Access to Contoso Apps?
HOTSPOT
You have a Microsoft Entra tenant named contoso.com that contains multiple enterprise apps.
Your company has a business partner that has a Microsoft Entra tenant named fabrikam.com.
You need to recommend an identity governance solution that will provide users in fabrikam.com with access to the enterprise apps in contoso.com. The solution must meet the following requirements:
• Ensure that administrators in fabrikam.com can provide the fabrikam.com users with access to the contoso.com enterprise apps.
• Automatically provision identities for the fabrikam.com users to enable access to the contoso.com enterprise apps.
• Provide policy-based management of access assignments, approvals, and expirations.
• Minimize administrative effort.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Community Insight
The question tests separating cross-tenant identity provisioning from access lifecycle governance; the trap is choosing manual B2B collaboration or access reviews as the complete solution.
Microsoft Entra identity governance for cross-tenant B2B access combines cross-tenant synchronization to provision Fabrikam users into Contoso with entitlement management access packages for delegated, policy-based app access. This page confirms both hotspot selections and explains why manual B2B invitations or access reviews alone fall short.
A common mistake is selecting Microsoft Entra B2B collaboration invitations alone because they create guest users. That approach lacks automated cross-tenant lifecycle provisioning and cannot deliver delegated access packages, approvals, or assignment expiration, so it fails three explicit requirements.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Entra cross-tenant synchronization automates the creation, update, and removal of Fabrikam B2B users in the Contoso tenant, satisfying the automatic identity provisioning requirement. Entitlement management publishes access packages that bundle Contoso enterprise apps with policy-driven assignment, approval, and expiration, and it supports delegated administration so Fabrikam administrators can assign access to their own users. Together they minimize Contoso administrative effort because lifecycle and approvals are handled by policy rather than manual invitations. The hotspot therefore needs one selection for provisioning and one for access governance, matching these two features.Why Other Candidate Answers Are Wrong
Manual Microsoft Entra B2B collaboration invitations can create guest users but do not provide automated cross-tenant lifecycle provisioning, access packages, approvals, or expiration at scale. Access reviews alone validate existing access but do not grant app access or provision Fabrikam identities. Privileged Identity Management governs privileged Azure and Entra roles, not business-app access packages for external users. Conditional Access enforces sign-in policy after access exists and cannot satisfy delegated assignment or approval requirements. Lifecycle workflows can automate joiner/mover/leaver tasks, but they do not replace entitlement management access packages for external app assignment.Community Comment Notes
As AllanHouston noted, "Cross-tenant synchronization" handles identity provisioning while "Entitlement management" provides access packages with delegated administration, approvals, policies, assignment expiration, and lifecycle control. That comment maps cleanly to the two hotspot blanks and reinforces why a single feature is insufficient. No contrary community position is needed.Official Reference
Exam Strategy
For AZ-305 identity governance hotspots, map each requirement to a feature: automatic identity creation points to cross-tenant synchronization, while delegated packages, approvals, and expirations point to entitlement management. Do not pick one feature to satisfy all bullets unless it natively covers both provisioning and lifecycle governance.
Frequently Asked Questions
Why does cross-tenant synchronization alone not satisfy the Contoso app access requirement?
It provisions Fabrikam B2B identities in Contoso, but it does not provide access packages, approvals, or assignment expiration; entitlement management handles those governance controls.
Can Fabrikam administrators assign Contoso access packages to their own users?
Yes, entitlement management supports delegated administration, so Fabrikam admins can manage access package assignments for their users when Contoso grants that role.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →