When granting external users (such as contractors) access to Microsoft Entra resources like enterprise applications, the correct method is to invite them as guest users.
The Microsoft SC-300 Study Guide states:
"To collaborate with external users who authenticate using their existing accounts (e.g., Outlook.com, Gmail, or another Entra tenant), you must invite them as guest users using the Microsoft Graph API or the New- MgInvitation PowerShell cmdlet." In this scenario, the contractor uses [email protected], which is a personal Microsoft account. The New- MgInvitation cmdlet creates a guest user in the tenant that links to their external identity for authentication.

Explanation:

In the SC-300 materials on Microsoft Entra PIM for Azure resources and Azure Key Vault authorization, you' re guided to use Azure RBAC (data-plane roles)-not legacy access policies-when you need time-bound, approvable, least-privilege access managed through PIM. The guide explains that PIM can make users Eligible or Active for Azure resource roles and that Key Vault provides specific data actions via built-in RBAC roles. For secrets, the roles are scoped to a vault (and can be further restricted by resource scope) and are purpose-built:
* Key Vault Secrets Officer - described as allowing a user to "create, read, update, and delete secrets" without granting key or certificate permissions. This precisely satisfies User1's requirement to read and update Secret1 while keeping scope limited to secrets (least privilege compared to broader Owner
/Contributor).
* Key Vault Secrets User - documented to "read secret contents" only. This matches User2's requirement to read the contents of the secrets stored in Vault2 while preventing modification or management actions.
The SC-300 coverage stresses that RBAC roles for Key Vault separate permissions for keys, secrets, and certificates, enabling least privilege and PIM governance (eligible/activation, approvals, MFA, and just-in- time) for access to sensitive data.

See the Explanation for the complete step by step solution
Explanation:
To ensure that users in the Sg-Operations group see a tab named "Operations" containing only LinkedIn and Box applications in the My Apps portal, you can create a collection with these specific applications. Here's how to do it:
Sign in to the Microsoft Entra admin center:
Make sure you have one of the following roles: Global Administrator, Cloud Application Administrator, Application Administrator, or owner of the service principal.
Navigate to App launchers:
Go to Identity > Applications > Enterprise applications.
Under Manage, select App launchers.
Create a new collection:
Click on New collection.
Enter "Operations" as the Name for the collection.
Provide a Description if necessary.
Add applications to the collection:
Select the Applications tab within the new collection.
Click on + Add application.
Search for and select LinkedIn and Box applications.
Click Add to include them in the collection.
Assign the collection to the Sg-Operations group:
Select the Users and groups tab.
Click on + Add users and groups.
Search for and select the Sg-Operations group.
Click Select to assign the collection to the group.
Review and create the collection:
Select Review + Create to check the configuration.
If everything is correct, click Create to finalize the collection.
By following these steps, when users in the Sg-Operations group visit the My Apps portal, they will see a new tab named "Operations" that contains only the LinkedIn and Box applications1.
Please note that to create collections on the My Apps portal, you need a Microsoft Entra ID P1 or P2 license1.

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and Microsoft Learn module "Plan and implement Azure AD Seamless Single Sign-On (SSO)", Azure AD Seamless SSO allows domain-joined Windows devices (that are not necessarily Azure AD-joined) to automatically sign in to Azure AD without requiring users to re-enter their credentials.
How Azure AD Seamless SSO Works: When a user tries to access an Azure AD-integrated application (like Microsoft 365, Teams, or SharePoint Online), Azure AD redirects the authentication request to the on- premises Active Directory. The Seamless SSO feature uses a computer account ( AZUREADSSOACC ) created in Active Directory to authenticate users through Kerberos tickets automatically.
For the Kerberos-based SSO to work properly in a browser or client, the service principal name (SPN) used by Azure AD must be treated as a trusted intranet site. This ensures that Integrated Windows Authentication (IWA) can pass the user's Kerberos ticket automatically - without prompting for credentials.
Configuration Required on Windows 10 Devices: To enable automatic SSO without credential prompts, you must:
* Add the following URLs to the Intranet Zone in Internet Explorer or Microsoft Edge (and by extension, Windows Authentication settings):
* https: //autologon.microsoftazuread-sso.com
* https: //aadg.windows.net.nsatc.net
* Ensure Automatic logon with current user name and password is enabled for the Intranet Zone.
From Microsoft Documentation: "For Azure AD Seamless SSO to work, the client machines must be on the corporate network and the URLs 'https://autologon.microsoftazuread-sso.com' and 'https://aadg.windows.net.
nsatc.net' must be added to the users ' Intranet zone settings."
Other options are not correct because:
* A. Enable Enterprise State Roaming - Manages user settings across devices, unrelated to SSO.
* B. Configure Sign-in options - User-level authentication preferences, not required for Seamless SSO.
* C. Install Azure AD Connect Authentication Agent - Used for Pass-through Authentication (PTA), not for Seamless SSO.

To Answer this question accurately, we must analyze the Combined Security Information Registration experience in Interrupt Mode for a new user within an Azure AD (Microsoft Entra ID) tenant where both MFA and SSPR are enabled.
1. Understanding Combined Registration in Interrupt Mode: According to Microsoft documentation on Combined security information registration , this feature allows users to register their security methods for both Azure AD Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR) in a single, unified step.
* Interrupt Mode triggers when a user signs in and a policy (like Identity Protection or Conditional Access) requires them to register security infor mation immediately.
* Because the question states SSPR is enabled and MFA is enforced , the user is required to register methods that satisfy both policies.
2. Validating the Methods (Options Analysis):
* Option E: The Microsoft Authenticator app (Correct): The Microsoft Authenticator app is the primary and most recommended method in the combined registration flow. It satisfies the strong authentication requirement for MFA and can also be used for SSPR . Microsoft documentation explicitly lists the Microsoft Auth enticator app as a supported method that users can register during the combined experience.
* Option C: A one-time passcode email (Correct): While Email is not a valid method for Azure AD MFA (primary authentication), it is a supported and common method for SSPR .
* Documentation Extract: " Users can register the following methods... Email (SSPR only). "
* Since the question specifies that SSPR is enabled , the combined registration wizard requires the user to register SSPR methods in addition to MFA methods. Therefo re, registering an email address to receive a one-time passcode is a valid step User1 can take to complete the portion of the combined registration process related to SSPR.
* Option A: A FIDO2 security key (Incorrect for Initial Registration):
* Documentation Extract: " User registration of FIDO2 security keys... relies on the combined registration experience. Users must have already registered at least one Azure AD Multi- Factor Authentication method. "
* Because User1 is a new user (and likely does not have a Temporary Access Pass specified), they cannot use a FIDO2 key to complete the initial registration interrupt. They must first register a standard MFA method (like the Authenticator app) before they can add a FIDO2 key via the " Manage " mode (Security Info p age).
* Option B: A hardware token (Incorrect): Hardware OATH tokens are not self-registered by the user in the combined registration portal. They must be uploaded and assigned by an administrator via a CSV file. Therefore, User1 cannot " use " this method to complete the self-service registration process.
* Option D: Windows Hello for Business (Incorrect): Windows Hello for Business (WHfB) is provisioned at the device level (via Windows Settings or OOBE), not through the web-based Combined Registration interrupt wizard. Additionally, WHfB typically requires the user to have already completed MFA registration to provision the credential.
Conclusion: The only two methods from the list that a new user can actively register and use to complete the web-based Combined Registration interrupt wizard (satisfying both MFA and SSPR requirements) are the Microsoft Authenticator app (for MFA/SSPR) and Email (for SSPR).