Adventure Works wants to allow B2B collaboration so partner users can be invited as guests to Teams and SharePoint. However, they need to ensure guest users cannot enumerate other directory members or see other guest accounts in the directory. What should the admin configure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
External Collaboration Settings is your gatekeeper for what guests can see inside your tenant. The most restrictive setting means a guest can see their own stuff — the Teams and SharePoint content they were explicitly invited to — but they're blind to who else works at your company. They can't browse the directory, find employee emails, or see other guests. MFA (option A) is a good idea too, but it doesn't fix the enumeration problem.
Full explanation below image
Full Explanation
Microsoft Entra External Collaboration Settings (found under Microsoft Entra ID > External Identities > External collaboration settings) controls both who can invite guests and what guests can see within the tenant. The 'Guest user access' setting has three tiers: 1. Guest users have the same access as members (most permissive) — guests can enumerate the full directory. 2. Guest users have limited access to properties and memberships of directory objects — moderate restriction. 3. Guest user access is restricted to properties and memberships of their own directory objects (most restrictive) — guests can only see what they were explicitly given access to. Setting this to the most restrictive option directly satisfies the requirement to prevent guest enumeration of directory members and other guests.
Option A (Conditional Access with MFA for guests) is an excellent security control but addresses authentication, not directory visibility. Even with MFA enforced, a guest could still enumerate directory members if the access setting is permissive. Both controls complement each other but serve different purposes.
Option C (blocking all external collaboration in SharePoint) would prevent guests from accessing SharePoint content at all, which contradicts the business requirement to enable B2B collaboration. This is the wrong tool — it's a blunt instrument when the admin needs a scalpel.
Option D (separate tenant for partner collaboration) is an architectural over-engineering of the problem. Microsoft Entra B2B is designed for cross-tenant collaboration without needing a second tenant. Managing a second tenant adds significant operational overhead.
Exam tip: Questions about controlling what guest users can see or access in the directory point to External Collaboration Settings in Microsoft Entra ID. Questions about securing guest sign-in point to Conditional Access. These are different controls — know which problem each solves.