Examkin

Question

Difficulty: MediumSelf-Service Password Reset and External Identities

An organization configures the External Collaboration settings for their Microsoft Entra ID tenant as follows:
- Guest user access: Guest users have limited access to properties and memberships of directory objects
- Guest invite settings: Only users assigned to specific admin roles can invite guest users

The tenant has the following users:
- User1: Assigned the User Administrator role at the tenant level in Microsoft Entra ID.
- User2: Assigned the Owner role at the subscription level for the Azure subscription linked to the tenant.
- User3: A guest user who has been assigned the Guest Inviter role in Microsoft Entra ID.
- User4: Assigned the User Administrator role scoped to a specific Administrative Unit within the tenant.

Which users can invite external guest users to the tenant?

  1. User1 and User3 onlyAnswer
  2. B
    User1, User2, and User3 only
  3. C
    User1, User3, and User4 only
  4. D
    User1, User3, and any member of a dynamic group that is assigned the Guest Inviter role

Answer

User1 and User3 only
The correct answer is the option containing User1 and User3 only. In Microsoft Entra ID, when the guest invite settings are restricted to specific administrative roles, the permitted roles by default include Global Administrator, User Administrator, and Guest Inviter. User1 is a tenant-level User Administrator, and User3 has the Guest Inviter role, which allows them to invite guests even though User3 is a guest user. User2 has subscription-level Owner permissions, which is an Azure RBAC role and does not grant Microsoft Entra ID directory permissions. User4 is scoped to an Administrative Unit, which limits their administrative actions to that unit and does not allow them to perform tenant-level actions like inviting guest users. Finally, dynamic groups cannot be assigned directory roles, making that configuration invalid.

Step-by-Step Solution

1
Identify the Entra ID tenant-level roles that are permitted to invite guest users when guest invite settings are restricted to specific admin roles.
The permitted roles include Global Administrator, User Administrator, Directory Writers, and Guest Inviter.
This establishes the baseline of directory-level permissions required for guest invitation under the restricted policy.
2
Evaluate each user's permissions and scope against the permitted roles.
User1 holds the tenant-wide User Administrator role (permitted). User2 holds a subscription-level RBAC role, which does not grant Entra ID directory permissions (not permitted). User3 holds the Guest Inviter role (permitted). User4 is scoped to an Administrative Unit, which prevents tenant-wide actions like inviting guest users (not permitted).
This determines which of the individual users are capable of inviting guests based on their role and scope.
3
Evaluate the group assignment option for dynamic groups.
Entra ID roles cannot be assigned to dynamic groups; they can only be assigned to role-assignable groups with assigned membership.
This rules out the possibility of assigning the Guest Inviter role to a dynamic group.

Key Concept

Microsoft Entra ID External Collaboration settings control guest invitation rights. When restricted to specific admin roles, only tenant-wide administrative roles (such as User Administrator and Guest Inviter) are authorized. Azure RBAC roles do not grant these directory rights, and Administrative Unit scopes restrict directory administrators from performing tenant-wide operations.
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic