Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureEasy
A global media company is designing a Zero Trust architecture for its content creation and distribution platform. They frequently collaborate with external partners, freelancers, and agencies who require access to specific project files and applications. The company needs a secure and manageable way to grant these external users access without creating full internal accounts or replicating their identities across multiple systems. Access must be governed by conditional access policies.
- AImplement a Virtual Private Network (VPN) solution for all external access.
- BUtilize Azure AD B2B Collaboration to invite external users to access specific resources.
- CCreate local user accounts for each external collaborator in the company's on-premises Active Directory.
- DProvision dedicated virtual machines (VMs) for each external user to access resources.
Show answer & explanationAnswer & explanation
Correct answer: B. Utilize Azure AD B2B Collaboration to invite external users to access specific resources.
Azure AD B2B Collaboration allows organizations to securely share applications and services with external users while maintaining control over their access. External users use their own identities (e.g., work, school, or social accounts) and can be subject to the company's Conditional Access policies, eliminating the need for full internal accounts or identity replication.
Why the other options are wrong
- A. A VPN provides network access but doesn't inherently manage external identities, apply granular Zero Trust policies per user/resource, or integrate their existing identity providers.
- C. Creating local accounts for external users is unmanageable, does not scale, and requires manual identity management, which is against Zero Trust principles.
- D. Provisioning VMs for every external user is resource-intensive, expensive, and does not provide the streamlined identity management and conditional access benefits of B2B Collaboration.
Azure AD B2B Collaboration
A feature of Azure Active Directory that enables secure collaboration with external users by allowing them to sign in with their own identities.
- External users use their existing identities (e.g., Azure AD, Microsoft account, Google, federated).
- Access is granted to specific applications or resources, not the entire network.
- External users are subject to the host organization's Conditional Access policies.
- Simplifies user management and enhances security for external collaboration.
Memory trick: B2B: Best for Business-to-Business, Bring Your Own ID.