How to Give a Contractor Access to App1 Using Their outlook.com Credentials?

SC-300 By islever Editorial Last updated

Implement and manage identities for external users and tenants Plan, implement, and monitor the integration of enterprise applications

Short answer

B Run New-MgInvitation to invite [email protected] as a B2B guest who can authenticate externally and be assigned access to App1.

Question

You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1. A contractor uses the credentials of [email protected]. You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [email protected]. What should you do?
  1. Run the New-MgUser cmdlet.
  2. Run the New-MgInvitation cmdlet. Correct Answer
  3. Configure the External collaboration settings.
  4. Implement Microsoft Entra Connect sync.

Key Takeaways

The exam tests the difference between enabling external collaboration and actually creating the guest identity; the trap is selecting a settings configuration when the scenario asks for the action that provisions the contractor's access.

This SC-300 question tests how to grant a contractor who uses [email protected] access to an enterprise application in the contoso.com Microsoft Entra tenant. The answer is B: invite the contractor as a Microsoft Entra B2B guest user with New-MgInvitation so they can authenticate with their existing outlook.com credentials.

Common mistake: The most common wrong choice is C, Configure the External collaboration settings. Those settings control whether invitations can be sent and who may be invited, but they do not create the guest user object in contoso.com or grant access to App1.

Expert Analysis

Why the Answer Is Correct

New-MgInvitation creates a Microsoft Entra B2B guest user by sending an invitation to the external email address, in this case [email protected]. When the contractor redeems the invitation, the guest account in contoso.com is backed by the contractor's own outlook.com credential, so the contractor authenticates as [email protected]. After the guest object exists, you can assign it to App1 either directly or through a group. This matches the requirement to provide the contractor with access while keeping their existing external identity.

Why the Other Options Are Wrong

New-MgUser creates a new member user account inside contoso.com, which would force a new contoso.com credential and would not let the contractor authenticate as [email protected]. External collaboration settings are a prerequisite configuration that enables B2B invitations, but they do not invite the contractor or create the guest object needed for App1 access. Microsoft Entra Connect sync is used to synchronize on-premises Active Directory identities, and an outlook.com consumer account is not an on-premises synchronized identity, so option D is unrelated. The edge case raised by _marc is that settings let you 'can' provide access, but the exam asks what you should do to actually provide access, which is the invitation.

Community Comment Notes

Fijii states that the 'Graph command invitation is the right answer (New-MgInvitation)', and Sunth65 agrees that 'B. Run the New-MgInvitation cmdlet is the correct command!'. Both comments align with the technical requirement that a guest identity must be created before the contractor can be assigned to App1. As _marc argued, External collaboration settings exist so that you 'can' provide access, but the question wording asks for the action that provides access, not the tenant-wide configuration that permits it.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a scenario says an external user must keep authenticating with their own credentials, look for the B2B guest invitation action rather than tenant-wide collaboration settings. Settings enable the capability; the invitation cmdlet creates the guest identity that can then be assigned to the enterprise application.

Frequently Asked Questions

Why is New-MgInvitation needed instead of just configuring External collaboration settings?

External collaboration settings only enable B2B invitations and define who can be invited; New-MgInvitation actually creates the guest user object for [email protected] so it can be granted access to App1.

Why can't New-MgUser create the contractor access to App1?

New-MgUser creates a member account inside contoso.com with a contoso.com credential, but the contractor must authenticate as [email protected], which requires a B2B guest invitation.

More SC-300 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Fijii 👍 4 Answered B
    Graph command invitation is the right answer (New-MgInvitation)
  2. Sunth65 👍 3 Answered B
    B. Run the New-MgInvitation cmdlet is the correct command !
  3. _marc 👍 1 Answered C
    'that you can provide access'. External collab settings are there so you 'can' provide access. The command for invitation is when you 'do' provide access

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide