Examkin

Question

Difficulty: HardSelf-Service Password Reset and External Identities

You manage a Microsoft Entra ID tenant named corp.litware.com. The tenant contains the following:

* An administrative unit named AU1.
* A security group named Group1.
* A security group named Group2 that is a nested member of Group1.
* Standard internal member users and B2B guest users.

You need to configure the tenant to satisfy the following security and administration requirements:

1. Only the users in Group1 and Group2 must be permitted to use Self-Service Password Reset (SSPR).
2. Internal member users must be able to invite guest users, but B2B guest users must be blocked from inviting other guest users.
3. Guest invitations must be permitted only to the partner.com domain.

Which three actions should you perform? Each correct answer presents part of the solution.

  1. A
    Configure the Self-Service Password Reset enabled scope to Selected and specify Group1.
  2. Create a new flat security group containing all direct members of Group1 and Group2, and configure the Self-Service Password Reset enabled scope to Selected targeting the new group.Answer
  3. In the External collaboration settings, set the Guest invite restrictions to Member users and users assigned to specific admin roles can invite guest users.Answer
  4. D
    Add Group1 and Group2 to AU1, and configure the Self-Service Password Reset enabled scope to target AU1.
  5. In the External collaboration settings, select Allow invitations only to the specified domains under Collaboration restrictions, and add partner.com to the list of domains.Answer

Answer

To configure the tenant correctly, you must: create a new flat security group containing all direct members of both groups and target that group for Self-Service Password Reset (SSPR) enablement; in the External collaboration settings, set the Guest invite restrictions to allow member users and specific admin roles to invite guest users; and under Collaboration restrictions, select 'Allow invitations only to the specified domains' and add the partner domain to the list.
To satisfy the SSPR requirement, we must create a flat security group containing all members of the nested groups and target it, because SSPR enablement only supports a single group and does not evaluate nested group structures. To allow only internal members and administrators to invite guests, the Guest invite restrictions should be set to 'Member users and users assigned to specific admin roles can invite guest users'. To restrict guest invitations to the partner domain, we must configure the Collaboration restrictions to allow invitations only to the specified domain and add the partner domain to the list.

Step-by-Step Solution

1
Address the nested SSPR requirement by creating a flat security group containing all users from both Group1 and Group2, then configuring SSPR enablement to 'Selected' targeting this new group.
All intended users in both groups are enabled for SSPR, overcoming the limitation where SSPR group scoping does not evaluate nested group memberships.
Microsoft Entra ID SSPR enablement is limited to a single group and does not support nested group evaluation.
2
Configure B2B guest invitation permissions in the External collaboration settings by setting Guest invite restrictions to 'Member users and users assigned to specific admin roles can invite guest users'.
Internal member users retain guest invitation privileges, but guest users are blocked from sending invitations.
This configuration selectively permits members and admins to invite guests while excluding B2B guest users.
3
Configure domain-level B2B restrictions by selecting 'Allow invitations only to the specified domains (most restrictive)' under Collaboration restrictions and adding 'partner.com'.
Invitations are blocked for all domains except for the specified partner domain.
This establishes an allowlist for external collaboration to restrict guest onboarding to the designated partner.

Key Concept

Microsoft Entra ID SSPR scope configuration rules and External Identities B2B collaboration settings.
Estimated Time:3m 0s
Rate this question

Topics

Self-Service Password Reset and External Identities

More questions from this topic