SC-300 - Implement and Manage User Identities - Section 1.4

Configure external identity providers and cross-tenant synchronization for multi-tenant scenarios.

Configure external identity providers using SAML and WS-Fed federation and set up cross-tenant synchronization for multi-tenant organisations. Distinguish B2B direct connect from B2B collaboration and recognise when each model is appropriate.

external identity providersSAML and WS-Fed federationcross-tenant synchronizationB2B direct connect

Practice question for this objective

Free sampleImplement and Manage User Identitieshard

An administrator must let external partners from a company that runs its own identity provider redeem invitations by authenticating against that provider for their email domain, instead of receiving a one-time passcode. The partner runs a single identity provider that issues tokens using the WS-Federation protocol. Which configuration in Microsoft Entra ID supports redemption against that WS-Federation provider?

  • AA SAML/WS-Fed direct federation entry that maps the partner domain to the provider's metadata, issuer, and passive endpoint so partner users authenticate at home. Correct
  • BA Google identity provider entry mapped to the partner domain so users sign in with their existing federated credentials rather than a passcode.
  • CA cross-tenant access inbound trust setting that accepts the partner's multifactor claims, which also redirects authentication to their identity provider.
  • DAn email one-time passcode policy scoped to the partner domain, which forwards the passcode to the partner's WS-Federation provider for validation.
Know that SAML/WS-Fed direct federation lets B2B guests from a partner domain authenticate at their own SAML or WS-Federation identity provider on redemption. Direct federation in Microsoft Entra ID supports external identity providers that speak SAML 2.0 or WS-Federation. By mapping the partner domain to the provider's metadata, issuer URI, and passive authentication endpoint, invited guests from that domain are redirected to authenticate at their employer's identity provider rather than being issued a one-time passcode.

Why A is correct: Direct federation supports both SAML 2.0 and WS-Federation external identity providers, mapping a partner domain to the provider so its users authenticate at their own identity provider on redemption.

Why B is wrong: Google federation is real but is limited to gmail.com consumer accounts for self-service and B2B, so it cannot front a partner's own WS-Federation identity provider.

Why C is wrong: Inbound trust settings honour claims like multifactor authentication from another Entra tenant, but they do not redirect redemption to a non-Entra WS-Federation provider.

Why D is wrong: Email one-time passcode is the fallback that direct federation is meant to replace, and it never forwards a code to an external identity provider for validation.

See more SC-300 practice questions, answers explained.

More in this domain

Back to all Implement and Manage User Identities objectives, or the SC-300 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.