According to the Microsoft Identity and Access Administrator (SC-300) official study guide and Microsoft Learn module "Manage External Identities" , when granting external users (such as contractors) access to Azure AD resources, the recommended method is to invite them as guest users (B2B collaboration users) into your Azure AD tenant.
The New-AzureADMSInvitation cmdlet is the PowerShell command used to create an Azure AD B2B guest invitation. It sends an invitation to an external user (such as [email protected] ) and, upon acceptance, creates a corresponding guest user account in the tenant (for example, user1_outlook.com#EXT#@contoso.
com ). This account can then be assigned to enterprise applications like App1.
From Microsoft documentation:
"To provide external users access to resources in your organization, invite them as guests using Azure AD B2B collaboration. You can do this by running the New-AzureADMSInvitation cmdlet or via the Azure portal."
* B. Configure the External collaboration settings: These settings define collaboration policies (who can invite guests, restrictions, etc.) but do not invite users themselves.
* C. Add a WS-Fed identity provider: This is used to federate another identity provider (e.g., ADFS or another Azure AD tenant), not to onboard an individual external user.
* D. Implement Azure AD Connect: This tool synchronizes on-premises directories with Azure AD; it's not relevant for external users from Outlook.com.
Why not the other options: # Correct Answer: A. Run the New-AzureADMSInvitation cmdlet.

Explanation:
The users must first: Register for multi-factor authentication (MFA)
You must configure: A user risk policy
According to Microsoft SC-300 official learning materials and Exam Ref SC-300: Mic rosoft Identity and Access Administrator , when the requirement is to address the probability that user identities were compromised, the appropriate feature is Azure AD Identity Protection. Identity Protection detects risky sign- ins and risky users through continuous analysis of login behavior, location, device, and credential exposure signals.
Two types of policies can be created:
* Sign-in risk policy - Triggers actions based on suspicious sign-in behavior (for example, unfamiliar location).
* User risk policy - Triggers actions when the user's overall identity is deemed at risk (for example, compromised credentials).
The documentation specifies:
"When user risk is detected, the policy can require the user to change their password to remediate the risk.
Users must first be registered for MFA to perform secure password change operations." Therefore, before the user risk policy can be enforced, users must be enrolled in multi-factor authentication (MFA). MFA is used during the remediation step (password change) to verify the user's identity securely.
Thus, to meet the requirement for "the probability that user identities were compromised," you configure a user risk policy in Azure AD Identity Protection, and ensure that users first register for MFA so that they can complete password change or verification flows when risks are detected.

The retention period for Microsoft Entra (Azure AD) sign-in logs depends on the license (Free, P1, P2).
Microsoft's data retention documentation states that with a Microsoft Entra ID P1 license, sign-in data is retained for 30 days.
The relevant table in the "Microsoft Entra data retention" documentation shows:
* With Entra ID P1 or P2: sign-in activity is retained for 30 days
* (With Free tier, sign-in logs are retained for 7 days)
Therefore, under your scenario (tenant has ID P1 license), the logs are available for 30 days.

The SC-300 official study guide and Microsoft Learn: Manage Access Reviews confirm that Access Reviews in Azure AD can target user-based groups, Azure AD roles, and enterprise applications. However, dynamic device groups are not supported for access reviews.

According to the official Microsoft SC-300 Study Guide and Microsoft Entra Permissions Management documentation, onboarding Microsoft Entra Permissions Management (formerly CloudKnox) involves two key setup tasks:
* Configuring Data Collection - After purchasing the license, you must connect your Azure subscription (s) to Permissions Management so it can inventory identities, roles, and permissions. This is done from the Microsoft Entra Permissions Management portal, where you enable data collection for each connected cloud environment (Azure, AWS, GCP). This process deploys the required collector identity (service principal) and defines the scope for data gathering.
* Creating Role Assignments - Permissions Management requires proper authorization to read role assignments, permissions, and activity data. You must create a role assignment at the subscription level (Sub1) using a least-privilege role (for example, Reader or CloudKnox Service Principal Role) for the Permissions Management application service principal. This ensures it can scan Azure resources for permission analysis.
Microsoft documentation confirms:
"To onboard Azure subscriptions, assign the CloudKnox service principal a Reader role on each subscription, and configure data collection from within Microsoft Entra Permissions Management."