AZ-301 Exam - Question 26

Question

A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft Office 365 and an Azure subscription.

Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS), Active Directory

Federation Services (AD FS), Azure AD Connect, and Microsoft Identity Manager (MIM).

Contoso has a partnership with a company named Fabrikam, Inc. Fabrikam has an Active Directory forest and an Office 365 tenant. Fabrikam has the same on- premises identity infrastructure as Contoso.

A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource in the Contoso subscription.

You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources.

What should you recommend?

Examice · Accepted Answer

To ensure that Contoso can assign the Contributor role to the 10 Fabrikam developers while allowing them to use their existing credentials, the most efficient solution is to create guest accounts for the developers in the Azure AD tenant of Contoso. This approach leverages Azure AD B2B (Business to Business) collaboration, which allows external users to access resources using their existing credentials without the need for complicated trust configurations or additional overhead. This method is straightforward and aligns with best practices for managing external user access in a secure and manageable way.

kondapaturi · Answer

D is preferred solution as a organisation

Ekramy_Elnaggar · Answer

D is correct , this called Azure B2B

GB_SYD · Answer

Hi Jimmy, C will enable for all fabricam users instead of the 10

gboyega · Answer

Given Answer is correct.

C is not correct because it would give everybody at fabri... access and not just the 10 developers

zomb · Answer

how does D ensure they use "existing credentials" though?

glam · Answer

D. In the Azure AD tenant of Contoso, create guest accounts for the Fabrikam developers.

JimmyO · Answer

Think it is C. Both organisations have ADFS so a one trust may be the best option https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/identity/adfs

mykolaantoniv · Answer

Answer is D

Coolking · Answer

Answer is D

"You can use the capabilities in Azure Active Directory B2B to collaborate with external guest users and you can use Azure RBAC to grant just the permissions that guest users need in your environment."

Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-external-users

[Removed] · Answer

I think the proposed answer D is correct, because we can create guest accounts for the 10 developers, while they still can use there credentials (Azure AD B2B).

From what I understand it would require to setup a new Identity Provider in Contoso's AAD (External Identities => All identity providers => New SAML/WS-Fed IdP) and point it to Fabrikams ADFS infrastructure.

Can someone please confirm this?

https://docs.microsoft.com/en-us/azure/active-directory/b2b/what-is-b2b#integrate-with-identity-providers

Corona_Virus · Answer

Answer : C

Explanation:
Trust configurations - Configure trust from managed forests(s) or domain(s) to the administrative forest
* A one-way trust is required from production environment to the admin forest.
* Selective authentication should be used to restrict accounts in the admin forest to only logging on to the appropriate production hosts.
Reference:
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material

yemma · Answer

Answer's correct, guest users will use there actual credentials.

Harkonnen · Answer

I don't think that forest trust were designed with the intention of trusting external organisation users. It is more like a took for internal organisation departments or branches. For this reason, I would create guest accounts.

exams0123456 · Answer

The correct answer is D. We did this in our environment last month. Gave RBAC access to 2 support people from a partner for particular resource. In fact this is what you do whenever there is a Enterprise Premiere Support from Microsoft. You give their support engineer Guest access and assign requisite RBAC Roles.

Anonymous · Answer

Answer is D, check the statement in the Microsoft article: "A simple invitation and redemption process lets partners use their own credentials to access your company's resources"
https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

temporal111 · Answer

"Selective Authentication
To combat the above mentioned security loophole and have some control on the authentication, we can opt for the Selective Authentication level. In this level, not all users are authenticated by Domain Controllers by default. Instead, when a Domain Controller of Trusting Forest detects that an authentication request is coming from a trusted forest, it first validates whether the user account has been granted exclusive permission on the resource that is holding the object.

For example, a file share has been configured on a file server. If a user from a trusted forests wants to access that file share, that user account has to be explicitly granted "Allowed to Authenticate" right on the file server. Only then the Domain Controller will authenticate the user, otherwise Domain Controller will reject the authentication request, and the user will not be part of "Authenticated User" group." 
From : https://social.technet.microsoft.com/wiki/contents/articles/50969.active-directory-forest-trust-attention-points.aspx

sanketshah · Answer

D is correct answer

nickname82 · Answer

correct answer is the A reference az 304 page 14 question 53

MeasService · Answer

By looking at this, I would go for C. "The solution must ensure that the Fabrikam developers use their existing credentials to access resources."

Manchana · Answer

Answer is C...They can not use existing credentials with guest accounts.

Pierrick · Answer

Azure B2B is guest invitation and enables the partner to use their own identities and credentials. answer is correct. https://docs.microsoft.com/en-us/azure/active-directory/b2b/what-is-b2b

DLyte · Answer

I thin answer is C
"Manage access to Azure resources for external guest users using RBACRole-based access control (RBAC) allows better security management for large organizations and for small and medium-sized businesses working with external collaborators, vendors, or freelancers that need access to specific resources in your environment, but not necessarily to the entire infrastructure or any billing-related scopes. You can use the capabilities in Azure Active Directory B2B to collaborate with external guest users and you can use RBAC to grant just the permissions that guest users need in your environment"

SkyDream · Answer

Answer is D
https://docs.microsoft.com/en-us/azure/active-directory/b2b/what-is-b2b

milind8451 · Answer

Azure AD B2B permission is needed in this scenario, so "D" is right ans.

corona2020 · Answer

I will go with D because why give access to everyone at fabrikam instead of those 10 developers.

Baranli · Answer

Option C -- Correct , As per question ,  Both Organization having same "premises identity infrastructure" One way Domain trust is best choice.

Prash85 · Answer

Create a one-way forest trust  Option: C is the correct answer

zarl · Answer

I think it is C. The key is "developers use their existing credentials"

Afz · Answer

D should be right answer using B2B but also depends on ensuring that the ADFS of Fabricano is configured  in B2B so that they can use their existing credentials.  B2B can integrate with ADFS, other AAD, Google Federation, MS accounts etc

Rooh · Answer

Given answer looks correct

Afz · Answer

B2B can integrate with other Federation services (ADFS, Google federation etc) and other AAD tenants. Fabrikam should have ADFS has since it has similar infrastructure. So it is guest users that is option d.

alokpsingh · Answer

Correct answer is A

alokpsingh · Answer

Correct answer is C

hchafloque · Answer

After comparing answers with other pages C wins. That's because both are already using FS, and that requires trust policies. Usually D should be enought, but looks like a MS answer is required. Thanks for answers, I learn a lot.

Junooni · Answer

Correct answer is C, pay close attention to last sentence : the solution must ensure that the Fabrikam developers use their existing credentials to access resources. Only possible with Option C

Ario · Answer

dont make it complicated :

With Azure AD B2B, the partner uses their own identity management solution, so there is no external administrative overhead for your organization. Guest users sign in to your apps and services with their own work, school, or social identities.

The partner uses their own identities and credentials; Azure AD is not required.
You don't need to manage external accounts or passwords.
You don't need to sync accounts or manage account lifecycles.

AZ-301 Exam - Question 26

Discussion