A public-works manager says inviting a consulting firm as Entra guests is the same as opening a storage account to anonymous internet access. What is the correct clarification?
Select an answer to reveal the explanation.
Short Explanation
Guests still sign in as real people—they just live outside the city's home directory. Public anonymous storage is more like leaving the file cabinet on the sidewalk. Those are not the same control.
Full Explanation
External identities are authenticated people or organizations outside the municipal directory who collaborate under invitation and policy—typically as Microsoft Entra B2B guests. They still prove identity, appear in directory objects and audits, and receive only the permissions administrators assign. Public anonymous storage, by contrast, exposes blobs or containers without requiring a signed-in principal. Those are different security concepts: one is identity-scoped collaboration; the other removes authentication for object access. Clarifying that distinction prevents a public-works manager from equating a guest invite with opening Blob data to the internet.
The approaches are not identical, and guests do authenticate. External identities are not an Azure SQL firewall IP feature; SQL firewall rules control network reachability to a database endpoint, not guest collaboration. Opening anonymous Blob access does not automatically create Entra guest users—those are separate configuration actions with opposite trust models.
Exam caveat: AZ-900 often pairs “guest/external identity” against “public anonymous access” distractors; pick the option that still requires authentication and directory governance.
Operational check: review the consulting firm’s guest user object in Microsoft Entra ID and confirm assigned app/resource permissions, then separately inspect any storage account anonymous/public access settings and ensure project data is not exposed without authentication.