Correct Answer: Azure AD External Identities with cross-tenant access settings allowing the vendor's tenant users to access the storage resource
Azure AD External Identities with cross-tenant access settings (outbound settings) let you grant access to users from a specific external tenant without creating guest objects in y...
Correct Answer
Azure AD External Identities with cross-tenant access settings allowing the vendor's tenant users to access the storage resource
Why This Answer Is Correct
Azure AD External Identities with cross-tenant access settings (outbound settings) let you grant access to users from a specific external tenant without creating guest objects in your directory. The vendor authenticates with their own Azure AD identity, and you assign them RBAC on the storage account. This preserves their corporate identity and requires no guest account creation.
This question evaluates your knowledge of Azure Active Directory — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding Azure Active Directory is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
A user in your Azure AD tenant is reporting they can sign in successfully but cannot access a specific Azure resource even though they are a member of a group that has the Contributor role on that resource. What should you investigate first?
Your organization requires that all Azure AD global administrator accounts use phishing-resistant MFA only. You must enforce this without creating per-user MFA settings and in a way that applies to all current and future global admins. What is the recommended approach?
Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?
Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?