How to Give a Contractor Access to App1 Using Their outlook.com Credentials?
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1. A contractor uses the credentials of [email protected]. You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [email protected]. What should you do?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the difference between enabling external collaboration and actually creating the guest identity; the trap is selecting a settings configuration when the scenario asks for the action that provisions the contractor's access.
This SC-300 question tests how to grant a contractor who uses [email protected] access to an enterprise application in the contoso.com Microsoft Entra tenant. The answer is B: invite the contractor as a Microsoft Entra B2B guest user with New-MgInvitation so they can authenticate with their existing outlook.com credentials.
The most common wrong choice is C, Configure the External collaboration settings. Those settings control whether invitations can be sent and who may be invited, but they do not create the guest user object in contoso.com or grant access to App1.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
New-MgInvitation creates a Microsoft Entra B2B guest user by sending an invitation to the external email address, in this case [email protected]. When the contractor redeems the invitation, the guest account in contoso.com is backed by the contractor's own outlook.com credential, so the contractor authenticates as [email protected]. After the guest object exists, you can assign it to App1 either directly or through a group. This matches the requirement to provide the contractor with access while keeping their existing external identity.Why the Other Options Are Wrong
New-MgUser creates a new member user account inside contoso.com, which would force a new contoso.com credential and would not let the contractor authenticate as [email protected]. External collaboration settings are a prerequisite configuration that enables B2B invitations, but they do not invite the contractor or create the guest object needed for App1 access. Microsoft Entra Connect sync is used to synchronize on-premises Active Directory identities, and an outlook.com consumer account is not an on-premises synchronized identity, so option D is unrelated. The edge case raised by _marc is that settings let you 'can' provide access, but the exam asks what you should do to actually provide access, which is the invitation.Community Comment Notes
Fijii states that the 'Graph command invitation is the right answer (New-MgInvitation)', and Sunth65 agrees that 'B. Run the New-MgInvitation cmdlet is the correct command!'. Both comments align with the technical requirement that a guest identity must be created before the contractor can be assigned to App1. As _marc argued, External collaboration settings exist so that you 'can' provide access, but the question wording asks for the action that provides access, not the tenant-wide configuration that permits it.Official Reference
Exam Strategy
When a scenario says an external user must keep authenticating with their own credentials, look for the B2B guest invitation action rather than tenant-wide collaboration settings. Settings enable the capability; the invitation cmdlet creates the guest identity that can then be assigned to the enterprise application.
Frequently Asked Questions
Why is New-MgInvitation needed instead of just configuring External collaboration settings?
External collaboration settings only enable B2B invitations and define who can be invited; New-MgInvitation actually creates the guest user object for [email protected] so it can be granted access to App1.
Why can't New-MgUser create the contractor access to App1?
New-MgUser creates a member account inside contoso.com with a contoso.com credential, but the contractor must authenticate as [email protected], which requires a B2B guest invitation.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →