A contractor from an external staffing agency needs temporary access to Cascade Regional Airlines' shared maintenance-scheduling document library for a six-week engagement, but should never receive a company email mailbox or a full employee identity. What is the appropriate way to grant this access in Microsoft Entra ID?

Microsoft Entra B2B collaboration lets an admin invite an external user by email; the invited person authenticates with their own organization's or personal credentials and is represented in the tenant as a guest object that can be added to groups and granted access to specific resources, all without provisioning a mailbox or a full internal identity. That's the exact mechanism the scenario calls for: temporary, scoped access without the overhead or risk of a full employee account. Creating a full internal account with a mailbox contradicts the requirement directly and leaves an orphaned identity to clean up (or forget to clean up) after six weeks. Cross-tenant synchronization is real but answers a different question — it keeps B2B users in step between two tenants an organization already owns, so using it here means standing up and administering an entire tenant for one six-week contractor, and it still lands on the same guest object a single invitation produces directly. Adding a personal email directly into on-premises Active Directory conflates an external contractor with an internal, synced identity and isn't how B2B guest access works at all. An exam-relevant caveat: external collaboration settings can restrict which domains or users are allowed to invite guests, so an admin should confirm the tenant's guest invite settings permit the staffing agency's domain. An operational check is verifying the guest account shows a UserType of Guest and testing that they can reach only the intended library.