A housing authority must let outside counsel review selected case materials through guest access. Which Microsoft Entra ID concept should the team map first?

Microsoft Entra ID supports external or guest identity access so outside counsel can review selected housing-authority case materials without sharing an internal staff password. Mapping guest access through Entra ID first establishes a governed identity for the counsel user, then pairs it with least-privilege SharePoint or Teams sharing—keeping municipal casework attributable and revocable. That Entra guest concept is the correct first mapping for the scenario. Entra ID B2C customer sign-up flow with self-service registration rather than sharing one internal staff password fails because B2C is built for customer-facing applications, not for inviting outside counsel as guests to review municipal case materials. Entra ID Privileged Identity Management activation for admin roles rather than sharing one internal staff password fails because outside counsel needs guest access to selected materials, not elevated administrative roles on the case-management system. Entra ID Conditional Access policy for compliant device access rather than sharing one internal staff password fails because the scenario asks which identity concept to map first for outside counsel, not which device-compliance condition to apply to the document library. Exam caveat: AB-900 emphasizes recognizing guest/external identity via Entra ID, not B2C self-service registration, PIM activation for admin roles, or Conditional Access for compliant device access. Shared internal passwords and over-privileged roles are classic wrong patterns. Keep counsel at guest plus resource least privilege with auditing on. Operational check: Invite outside counsel as an Entra guest, grant only the specific case site or library permissions required, keep Global Administrator far away from guest accounts, ensure audit logging remains enabled, and remove guest access when review ends. Confirm counsel never receives a shared internal staff password.