Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceHard
A global company uses Microsoft Entra ID and has several business units, each operating as a distinct legal entity with its own Microsoft Entra tenant. They want to enable seamless collaboration by allowing users from one business unit to request access to applications and resources owned by another business unit's tenant, all managed through entitlement management. The solution must support self-service access requests and automatic de-provisioning. Which type of connected organization should the company configure in each tenant to enable this cross-tenant collaboration?
- AMicrosoft Entra (external directory)
- BMicrosoft account (MSA)
- CDirect federation with an on-premises AD
- DExternal Entra ID (Cross-tenant synchronization)
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft Entra (external directory)
To enable collaboration and self-service access requests between different Microsoft Entra tenants (business units operating as distinct legal entities), you must configure a connected organization of type 'Microsoft Entra (external directory)' for each partner tenant. This facilitates B2B collaboration.
Why the other options are wrong
- B. Microsoft account (MSA) is for personal Microsoft accounts, not for other Microsoft Entra organizations.
- C. Direct federation with on-premises AD is for integrating a local Active Directory with a single Microsoft Entra tenant and is not relevant for cross-tenant collaboration between distinct Entra ID tenants.
- D. While 'External Entra ID' is conceptually correct, 'Cross-tenant synchronization' is a specific feature for synchronizing users, not a connected organization type for self-service access requests in entitlement management. The standard type is 'Microsoft Entra (external directory)'.
Microsoft Entra Connected Organization
A connected organization of type 'Microsoft Entra (external directory)' allows users from a partner Microsoft Entra tenant to request access packages, enabling B2B collaboration.
- Facilitates B2B collaboration between Microsoft Entra tenants.
- Allows self-service access requests for external users.
- Requires specifying the partner tenant's domain or tenant ID.
Memory trick: For tenant-to-tenant access, it's about connecting Entra IDs like business partners.