Alpine Ski House regularly works with external contractors from partner companies. The IT team wants these contractors to access specific Teams channels and SharePoint project sites via B2B collaboration. However, the security team has flagged a concern: they do not want guest users to be able to invite additional external users on their own. The global admin needs to configure this restriction. Which setting should be adjusted?
Select an answer to reveal the explanation.
Short Explanation and Infographic
This is a guestlist control problem — you want guests at the party but you don't want them to bring their own plus-ones. In Microsoft Entra's External Identities settings, you control who can send invitations. Restricting it to admins (and the Guest Inviter role) means your contractors can join but can't sponsor new guests themselves.
Full explanation below image
Full Explanation
The correct answer is A. Microsoft Entra External Identities provides a 'Guest invite settings' (also called guest invite restrictions) control that determines who in the tenant is authorized to send B2B collaboration invitations. The available options range from 'Anyone in the organization can invite' (most permissive) to 'Only users assigned to specific admin roles can invite' (most restrictive while still allowing B2B). By setting this to admin-only and ensuring guest users are not assigned the Guest Inviter role, Alpine Ski House prevents contractors from spawning additional external invitations. This is the precise, targeted control for this scenario.
Option B is wrong because 'Guest users have the same access as members' is a Guest user access restriction that controls what directory objects guests can read (like seeing the full user list), not who can send invitations. Choosing this setting would actually give guests more directory visibility, not less invitation power. It solves the wrong problem and introduces new risks.
Option C is wrong because cross-tenant synchronization is designed for organizations that want to provision users from a partner tenant into their own directory so they appear as internal users. It is an identity provisioning tool, not an invitation control mechanism, and would be far more complex than the scenario requires.
Option D is wrong because it is the nuclear option that eliminates the business value entirely. Alpine Ski House wants contractors to collaborate via Teams and SharePoint — blocking all guest access would prevent that legitimate use case. The goal is controlled access, not no access.
Exam tip: Microsoft Entra External Identities has two separate controls that sound similar but are different: (1) Guest invite restrictions — who can send invitations; (2) Guest user access restrictions — what directory data guests can see. Make sure you know which one is being tested.