How Does Microsoft Entra Govern Fabrikam B2B Access to Contoso Apps?
Short answer
Select Cross-tenant synchronization to auto-provision Fabrikam B2B users into Contoso, and Entitlement management for access packages with delegated assignment, approvals, and expiration.
Question
You have a Microsoft Entra tenant named contoso.com that contains multiple enterprise apps.
Your company has a business partner that has a Microsoft Entra tenant named fabrikam.com.
You need to recommend an identity governance solution that will provide users in fabrikam.com with access to the enterprise apps in contoso.com. The solution must meet the following requirements:
• Ensure that administrators in fabrikam.com can provide the fabrikam.com users with access to the contoso.com enterprise apps.
• Automatically provision identities for the fabrikam.com users to enable access to the contoso.com enterprise apps.
• Provide policy-based management of access assignments, approvals, and expirations.
• Minimize administrative effort.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The question tests separating cross-tenant identity provisioning from access lifecycle governance; the trap is choosing manual B2B collaboration or access reviews as the complete solution.
Microsoft Entra identity governance for cross-tenant B2B access combines cross-tenant synchronization to provision Fabrikam users into Contoso with entitlement management access packages for delegated, policy-based app access. This page confirms both hotspot selections and explains why manual B2B invitations or access reviews alone fall short.
Common mistake: A common mistake is selecting Microsoft Entra B2B collaboration invitations alone because they create guest users. That approach lacks automated cross-tenant lifecycle provisioning and cannot deliver delegated access packages, approvals, or assignment expiration, so it fails three explicit requirements.
Expert Analysis
Why the Answer Is Correct
Microsoft Entra cross-tenant synchronization automates the creation, update, and removal of Fabrikam B2B users in the Contoso tenant, satisfying the automatic identity provisioning requirement. Entitlement management publishes access packages that bundle Contoso enterprise apps with policy-driven assignment, approval, and expiration, and it supports delegated administration so Fabrikam administrators can assign access to their own users. Together they minimize Contoso administrative effort because lifecycle and approvals are handled by policy rather than manual invitations. The hotspot therefore needs one selection for provisioning and one for access governance, matching these two features.
Why Other Candidate Answers Are Wrong
Manual Microsoft Entra B2B collaboration invitations can create guest users but do not provide automated cross-tenant lifecycle provisioning, access packages, approvals, or expiration at scale. Access reviews alone validate existing access but do not grant app access or provision Fabrikam identities. Privileged Identity Management governs privileged Azure and Entra roles, not business-app access packages for external users. Conditional Access enforces sign-in policy after access exists and cannot satisfy delegated assignment or approval requirements. Lifecycle workflows can automate joiner/mover/leaver tasks, but they do not replace entitlement management access packages for external app assignment.
Community Comment Notes
As AllanHouston noted, "Cross-tenant synchronization" handles identity provisioning while "Entitlement management" provides access packages with delegated administration, approvals, policies, assignment expiration, and lifecycle control. That comment maps cleanly to the two hotspot blanks and reinforces why a single feature is insufficient. No contrary community position is needed.
Official Reference
- https://learn.microsoft.com/en-us/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview
- https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-overview
These links open the official vendor documentation in a new tab.
Exam Strategy
For AZ-305 identity governance hotspots, map each requirement to a feature: automatic identity creation points to cross-tenant synchronization, while delegated packages, approvals, and expirations point to entitlement management. Do not pick one feature to satisfy all bullets unless it natively covers both provisioning and lifecycle governance.
Frequently Asked Questions
Why does cross-tenant synchronization alone not satisfy the Contoso app access requirement?
Can Fabrikam administrators assign Contoso access packages to their own users?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
AllanHouston 👍 1For identity provisioning: Cross-tenant synchronization. It automatically creates, updates, and removes Fabrikam B2B identities in the Contoso tenant. For access management: Entitlement management. It provides access packages with delegated administration, approvals, policies, assignment expiration, and lifecycle control
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →