A company is implementing Microsoft Entra External Identities to allow partner organizations' researchers to access an AI experimentation portal. The security team requires that partner users must satisfy the home organization's MFA before accessing the portal. Which Entra External Identities trust setting achieves this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because in Entra External Identities cross-tenant access settings (Inbound access), you can configure trust settings per partner tenant. Enabling 'Trust MFA from Microsoft Entra tenants' means that when a partner user has already satisfied MFA at their home tenant, your tenant trusts that claim and does not re-challenge them.
Full explanation below image
Full Explanation
B is correct because in Entra External Identities cross-tenant access settings (Inbound access), you can configure trust settings per partner tenant. Enabling 'Trust MFA from Microsoft Entra tenants' means that when a partner user has already satisfied MFA at their home tenant, your tenant trusts that claim and does not re-challenge them. This allows the partner organization to manage its own MFA policies while ensuring MFA was performed. A is wrong because requiring MFA from the resource tenant would force re-authentication in your tenant, overriding the home organization's MFA, which is not the requirement. C is wrong because B2C is for consumer-facing identity scenarios, not B2B partner federation. D is wrong because one-time passcode is a fallback for guests without a Microsoft or social account, not an MFA trust mechanism.