According to the Microsoft Identity and Access Administrator (SC-300) official study guide and Microsoft Learn module "Manage External Identities" , when granting external users (such as contractors) access to Azure AD resources, the recommended method is to invite them as guest users (B2B collaboration users) into your Azure AD tenant.
The New-AzureADMSInvitation cmdlet is the PowerShell command used to create an Azure AD B2B guest invitation. It sends an invitation to an external user (such as [email protected] ) and, upon acceptance, creates a corresponding guest user account in the tenant (for example, user1_outlook.com#EXT#@contoso.
com ). This account can then be assigned to enterprise applications like App1.
From Microsoft documentation:
"To provide external users access to resources in your organization, invite them as guests using Azure AD B2B collaboration. You can do this by running the New-AzureADMSInvitation cmdlet or via the Azure portal."
* B. Configure the External collaboration settings: These settings define collaboration policies (who can invite guests, restrictions, etc.) but do not invite users themselves.
* C. Add a WS-Fed identity provider: This is used to federate another identity provider (e.g., ADFS or another Azure AD tenant), not to onboard an individual external user.
* D. Implement Azure AD Connect: This tool synchronizes on-premises directories with Azure AD; it's not relevant for external users from Outlook.com.
Why not the other options: # Correct Answer: A. Run the New-AzureADMSInvitation cmdlet.