Microsoft Entra Permissions Management (formerly CloudKnox) integrates with Azure subscriptions via a service principal that must read and write role assignments to analyze and right-size permissions. The User Access Administrator role provides this ability without full ownership privileges.
The SC-300 guide explicitly notes that to allow automatic monitoring and remediation of permissions, "the Permissions Management service principal must have the User Access Administrator role on the target subscription or management group to modify and create RBAC assignments." Reader (A) and Contributor (B) roles cannot manage RBAC permissions, while Owner (C) grants unnecessary broad control, violating the principle of least privilege.

Explanation:
According to the Microsoft SC-300 Study Guide, Exam Ref SC-300, and Microsoft Entra External Collaboration (B2B) documentation, the configuration of External collaboration settings in Azure AD determines how guest users can access directory data and who can invite them into the tenant.
Let's analyze each requirement in context:
Requirement 1: "Guest users must be prevented from querying staff email addresses." To achieve this, Azure AD provides the setting Guest user access restrictions, which defines what a guest can see in the directory. The most restrictive setting ensures that guest users can only see their own profile details and no other users or groups.
# Therefore, select:
"Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)." This prevents guests from discovering internal directory data such as email addresses of staff members or group memberships.
Requirement 2: "Guest users must be able to access the tenant only if they are invited by User1." User1 has the User Administrator role. This role is included among the "specific admin roles" allowed to invite guest users when the setting is configured appropriately.
To meet the requirement that only User1 (or other admins) can invite guests, you must configure:
# "Only users assigned to specific admin roles can invite guest users." This restricts invitation privileges to admin roles (such as Global Administrator, User Administrator, etc.) and prevents ordinary users or guests from inviting others.
Requirement 3: "Guests should not be able to self-enroll."
Azure AD B2B allows self-service sign-up through user flows (Identity Experience Framework). Enabling this feature would let external users sign up themselves - which violates the condition that guests must be invited by User1 only.
# Therefore, set Enable guest self-service sign-up via user flows = No.
Final Configuration Summary: Setting
Value
Guest user access restrictions
Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) Guest invite restrictions Only users assigned to specific admin roles can invite guest users Enable guest self-service sign-up via user flows No
# Microsoft Official Documentation Reference (SC-300 Content):
"To prevent guests from seeing other users in the directory, configure guest user access restrictions to 'most restrictive.' To control who can invite guests, use the setting that limits invitations to users with admin roles.
To disallow self-service guest access, disable user flows for external sign-up."

Explanation:

In SC-300, Microsoft emphasizes Azure AD B2B collaboration for cross-tenant access without extra Microsoft 365 licensing. The guidance explains that organizations can invite external users as guests to their tenant to access Microsoft 365 resources such as SharePoint Online and Teams , and guest access does not require an additional Microsoft 365 license for the guest . The host tenant remains licensed for the workloads being accessed, and Azure AD billing for B2B collaboration is handled through External Identities (MAU) if configured. The study content also notes that synchronizing a single on-premises AD forest to multiple Azure AD tenants is not a supported topology with a single Azure AD Connect server, and deploying another AAD Connect to sync the same identities to a second tenant introduces complexity and is unnecessary when the requirement is simply to let users in one tenant access resources in another. Application Proxy (publishing on-prem apps) is unrelated to granting SharePoint Online cross-tenant access. Therefore, the minimum-effort, license-compliant approach is to invite Contoso East users as B2B guests in the Contoso West tenant and assign them the required SharePoint permissions.