A partner nonprofit needs limited access to a city planning app but should not receive a full municipal employee account. Which Azure identity approach fits that use case?
Select an answer to reveal the explanation.
Short Explanation
Partners who need a slice of access—not a city badge for life—are a textbook external-identity scenario. Guest access keeps them outside the full employee roster while still letting them sign in. Full Owner for every volunteer is the opposite of limited access.
Full Explanation
When a partner nonprofit needs limited access to a city planning app without becoming a municipal employee, the fitting Microsoft Entra approach is an external (guest) identity. Guest collaboration lets the partner authenticate and receive only the app or resource permissions you assign, while lifecycle controls remain with the city’s directory administrators. That keeps access attributable, reviewable, and revocable without inventing full employee accounts for every volunteer or partner staff member.
Assigning subscription Owner to every nonprofit volunteer by default violates least privilege at the highest management-plane scope and far exceeds limited app access. Disabling Entra ID and sharing one global admin password removes identity governance, destroys auditability, and creates catastrophic blast radius if the secret leaks. Moving the planning app to an unmanaged public website with no authentication abandons municipal access control entirely rather than solving limited partner access.
Exam caveat: guest access is still access—pair it with least-privilege roles and Conditional Access expectations rather than treating “external” as inherently low risk.
Operational check: invite the nonprofit contact as a B2B guest, grant only the planning-app group or role required, deny subscription-wide privileged roles, and validate that the guest cannot reach unrelated city resources before announcing go-live.