An administrator must let external partners from a company that runs its own identity provider redeem invitations by authenticating against that provider for their email domain, instead of receiving a one-time passcode. The partner runs a single identity provider that issues tokens using the WS-Federation protocol. Which configuration in Microsoft Entra ID supports redemption against that WS-Federation provider?
- AA SAML/WS-Fed direct federation entry that maps the partner domain to the provider's metadata, issuer, and passive endpoint so partner users authenticate at home. Correct
- BA Google identity provider entry mapped to the partner domain so users sign in with their existing federated credentials rather than a passcode.
- CA cross-tenant access inbound trust setting that accepts the partner's multifactor claims, which also redirects authentication to their identity provider.
- DAn email one-time passcode policy scoped to the partner domain, which forwards the passcode to the partner's WS-Federation provider for validation.
Why A is correct: Direct federation supports both SAML 2.0 and WS-Federation external identity providers, mapping a partner domain to the provider so its users authenticate at their own identity provider on redemption.
Why B is wrong: Google federation is real but is limited to gmail.com consumer accounts for self-service and B2B, so it cannot front a partner's own WS-Federation identity provider.
Why C is wrong: Inbound trust settings honour claims like multifactor authentication from another Entra tenant, but they do not redirect redemption to a non-Entra WS-Federation provider.
Why D is wrong: Email one-time passcode is the fallback that direct federation is meant to replace, and it never forwards a code to an external identity provider for validation.