SC-300 coverage of Azure AD B2B collaboration states that to grant an external person access to your enterprise application, you invite them as a guest using their existing identity (such as a Microsoft account like [email protected] ). The documentation emphasizes that B2B "lets you collaborate with external users by adding them to your directory as guest users using their existing credentials." Once invited, the guest can authenticate in their home identity provider and be assigned to the target enterprise application (App1) through app role assignment or group membership. You do not need to create a new managed user or add a WS-Federation identity provider for Outlook.com; Azure AD natively supports Microsoft Accounts for B2B invitations, controlled by External collaboration settings (which generally allow invitations to any domain by default). Consequently, to ensure the contractor can authenticate as [email protected] and access App1, you should create a guest user (invite) in the contoso.com tenant and assign that guest to App1.