SC-300 coverage of Azure AD B2B collaboration states that to grant an external person access to your enterprise application, you invite them as a guest using their existing identity (such as a Microsoft account like [email protected] ). The documentation emphasizes that B2B "lets you collaborate with external users by adding them to your directory as guest users using their existing credentials." Once invited, the guest can authenticate in their home identity provider and be assigned to the target enterprise application (App1) through app role assignment or group membership. You do not need to create a new managed user or add a WS-Federation identity provider for Outlook.com; Azure AD natively supports Microsoft Accounts for B2B invitations, controlled by External collaboration settings (which generally allow invitations to any domain by default). Consequently, to ensure the contractor can authenticate as [email protected] and access App1, you should create a guest user (invite) in the contoso.com tenant and assign that guest to App1.

This question refers to Azure AD Entitlement Management under Identity Governance . The goal is to let User1 modify the review frequency (i.e., Access Reviews) for an existing access package named Package1
, following the principle of least privilege .
In Azure AD, the ability to create and manage access packages, catalogs, and access reviews is granted through certain admini strative roles:
* Global Administrator and Identity Governance Administrator - Full control over all Identity Governance settings.
* Catalog Owner or Access Package Manager - Manage access packages and settings within a catalog.
* User Administrator - Can config ure access reviews and manage users, groups, and limited governance settings.
* Privileged Role Administrator , Security Administrator , and External Identity Provider Administrator - Have no direct control over access review settings in Entitlement Management.
From Microsoft documentation ( "Azure AD Entitlement Management Delegation and Roles" ):
"A user administrator can manage access reviews and entitlement management settings for the directory and assigned catalogs, including adjusting the review f requency or review settings." Thus, to modify the Access Review configuration (frequency, reviewers, etc.) in Package1 , the User Administrator role provides the minimum necessary privilege without granting excessive permissions like Identity Governance Adm inistrator or Global Administrator.

Explanation:
< Statement 1 # No
Statement 2 # No
Statement 3 # Yes
According to the Microsoft SC-300: Microsoft Identity and Access Administrator study guide and Azure AD Privileged Identity Management (PIM) documentation, roles in PIM can be configured for eligible or active assignments.
* User1 is assigned automatically - No The "Add assignments" screen shows User1's assignment type as Eligible, not Active. Eligible assignments mean the user is not automatically granted the role; they must activate it manually when needed. Therefore, User1 is not assigned automatically to the Application Administrator role.
* When User2 requests role assignment, only User3 can approve - No The Role setting details show that approval is required to activate and that the approver is listed as Group1. Because both User2 and User3 are members of Group1, any member of the group can approve the request, not only User3. Hence, the statement that only User3 can approve is incorrect.
* User1's approval on January 31, 2021, at 23:00 - Yes The configuration shows an activation maximum duration of 5 hours. Therefore, if User1's request is approved at 23:00 on January 31, the role remains active for 5 hours - until 04:00 on February 1, 2021. This aligns precisely with the parameters displayed in the exhibit.
As confirmed in Microsoft documentation ( "Configure role settings in Azure AD PIM" ), activation settings define how long a user can remain active after approval, and group approvers allow any member of that group to approve activations.

Explanation:

Explanation:
Based on the official Microsoft SC-300 study guide and Microsoft Entra ID (Azure AD) licensing documentation, the licensing requirement for Access Reviews depends on who is being reviewed and how the review is configured .
Access reviews are an Azure AD Premium P2 feature (included in Microsoft 365 E5), and the licensing model specifies that:
"Each user who is part of an access review (either being reviewed or reviewing) must have an Azure AD Premium P2 license, except in cases where guest users are reviewed by internal reviewers - in that case, only the reviewers require a license." Let's analyze each configuration:
* Members: 500 internal + 25 guest users = 525 total members.
* Review Type: Teams + Groups
* Review Scope: All users
* Reviewers: Users review own access
Group1 Since all users (internal and guest) review their own access, every member is considered an active participant in the review. Therefore, each of the 525 members (500 internal + 25 guests) must have an Azure AD Premium P2 license.
# Group1 = 525 licenses required
* Members: 295 internal + 100 guest users = 395 total members.
* Review Type: Teams + Groups
* Review Scope: Guest users only
* Reviewers: Group owner
Group2 Here, only guest users are being reviewed, and the reviewer is the group owner (User2). Since the guest users don't require licenses when being reviewed by an internal reviewer, only the group owner (User2) needs a P2 license.
# Group2 = 1 license required
# According to Microsoft Licensing Guidance (SC-300 Official Content):
"If guest users review their own access, each guest requires a P2 license. If the review is conducted by an internal user (owner or admin), only that reviewer requires the license."