Configuring Collaboration Restrictions for Guest Invites

SC-300 By islever Editorial Last updated

Short answer

D Configure Collaboration Restrictions to allow or deny specific external domains like adatum.com in Microsoft Entra ID.

Question

You work for a company named Contoso, Ltd. that has a Microsoft Entra tenant named contoso.com. Contoso is working on a project with the following two partner companies: • A company named A. Datum Corporation that has a Microsoft Entra tenant named adatum.com. • A company named Fabrikam, Inc. that has a Microsoft Entra tenant named fabrikam.com. When you attempt to invite a new guest user from adatum.com to contoso.com, you receive an error message. You can successfully invite a new guest user from fabnkam.com to contoso.com. You need to be able to invite new guest users from adatum.com to contoso.com. What should you configure?
  1. Guest invite settings
  2. Verifiable credentials
  3. Named locations
  4. Collaboration restrictions Correct Answer

Key Takeaways

The scenario isolates a failure to one partner domain while another succeeds, indicating a granular policy restriction rather than a global setting or network location issue.

This question tests the configuration of external collaboration policies in Microsoft Entra ID to resolve domain-specific guest invitation failures. It establishes that restricting specific domains via Collaboration Restrictions is the correct administrative action.

Common mistake: Candidates often select 'Guest invite settings' (Option A), assuming a global toggle is the cause, but this fails because it does not address the specific domain-level block affecting only adatum.com.

Expert Analysis

Why the Answer Is Correct

The ability to invite users from fabrikam.com but not adatum.com confirms that global guest invitations are enabled, but a specific restriction exists for the adatum.com domain. In Microsoft Entra ID, under External Identities > External collaboration settings, administrators can configure 'Collaboration restrictions'. By selecting 'Allow invitations only to the specified domains' and adding adatum.com, or ensuring it is not in a 'Deny' list, access is restored. This granular control is distinct from the broader 'Guest invite settings'.

Why the Other Options Are Wrong

Guest invite settings (A) control whether anyone can be invited or if admins must approve them, but they do not filter by specific external domains in the way described. Verifiable credentials (B) relate to identity proofing and digital IDs, not invitation routing. Named locations (C) are used in Conditional Access policies based on IP addresses or countries, which would not typically block a specific tenant's email domain unless tied to a very specific IP range, making Collaboration Restrictions the direct and intended solution.

Community Comment Notes

Community consensus strongly supports Option D. Users note that the error implies a domain-specific block within External Collaboration Settings. One commenter highlighted that you can either add the domain to an allow-list or check for a deny-list entry. Another user confirmed the navigation path: External Identities >> External Collab Settings >> Collaboration Restrictions. The high vote count reflects confidence in this specific configuration area.

Exam Strategy

When troubleshooting guest access issues, always differentiate between global restrictions (Guest Invite Settings) and granular domain restrictions (Collaboration Restrictions). If one domain works and others don't, look for domain-specific allow/deny lists in the External Collaboration settings.

Frequently Asked Questions

What is the difference between Guest Invite Settings and Collaboration Restrictions?

Guest Invite Settings control who can send invitations (members vs admins). Collaboration Restrictions control which external domains are allowed or blocked from being invited.

Why doesn't changing Guest Invite Settings fix this issue?

Because the issue is isolated to one domain (adatum.com) while another (fabrikam.com) works. Guest Invite Settings apply globally and cannot target specific external tenants.

More SC-300 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. penatuna 👍 6 Answered D
    You can select “Allow invitations to be sent to any domain (most inclusive)” to allow guest invites to be sent to any domain. You can also select “Allow invitations only to the specified domains (most restrictive)”, and add adatum.com to it. OR you can check if “Deny invitations to the specified domains” is selected, and contoso.com is in there. However, you can find all of the above in Microsoft Entra admin centre | External Identities | External collaboration settings | Collaboration restrictions.
  2. avdan16 👍 6
    You need to add adatum.com to the list of domains on External Identities >> External Collab Settings >> Collaboration Restrictions >> Allow invitations only to the specified domains.
  3. d1e85d9 👍 1 Answered D
    The correct answer is: D. Collaboration restrictions Explanation: Since you are unable to invite guest users from adatum.com but can invite users from fabrikam.com, this indicates that there is a restriction on external collaboration for certain domains. In Microsoft Entra ID (formerly Azure AD), Collaboration restrictions allow organizations to control which external domains can be invited as guest users. If adatum.com is blocked, you will see an error when attempting to invite users from that domain. To resolve this issue: Go to Microsoft Entra admin center. Navigate to External Identities > External collaboration settings. Under Collaboration restrictions, check if adatum.com is blocked and remove it from the restricted list. Thus, the correct setting to configure is Collaboration restrictions.
  4. bardock100 👍 1 Answered C
    C) External Identities | External collaboration settings | Collaboration restrictions
  5. SFAY 👍 4 Answered D
    Correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide