You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains an Azure AD enterprise application named App1. A contractor uses…

The requirement is to grant an external contractor, using their personal outlook.com Microsoft Account (MSA), access to an enterprise application. The standard and most appropriate method for this in Azure AD is B2B collaboration. This involves inviting the external user as a guest. The invitation process creates a guest user account object in the contoso.com tenant that is linked to the contractor's external identity ([email protected]). This allows the contractor to authenticate using their existing credentials while enabling you to assign them permissions to internal resources like App1.

A. Run the New-AzADUser cmdlet.

This cmdlet creates a new member user, which is an internal account with credentials managed by your tenant, not a guest who uses their own identity.

B. Configure the External collaboration settings.

These settings define policies for B2B collaboration (e.g., who can invite guests) but do not perform the action of inviting a specific user.

C. Add a WS-Fed identity provider.

This is for setting up direct federation with an organization's identity provider (like ADFS), not for individual Microsoft Accounts like outlook.com.

---

1. Microsoft Learn

"What is Azure Active Directory B2B collaboration?": "Azure AD B2B collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. ... Guest users sign in to your apps and services with their own work

school

or social identities." This directly supports using B2B collaboration for external users with social identities like an MSA.

Source: Microsoft Documentation

Azure Active Directory > External Identities > What is B2B collaboration?

Introduction section.

2. Microsoft Learn

"Add Azure Active Directory B2B collaboration users in the Azure portal": "You can invite guest users to the directory

to a group

or to an application. After you send the invitation

the user account is automatically added to the directory as a guest." This confirms that the action of inviting results in the creation of a guest user account.

Source: Microsoft Documentation

Azure Active Directory > External Identities > How-to guides > Add B2B collaboration users in the Azure portal

"Invite a guest user to your directory" section.

3. Microsoft Learn

"Properties of an Azure Active Directory B2B collaboration user": "A B2B collaboration user is a user with UserType set to Guest. This guest user in your directory is the result of inviting a guest user to collaborate..." This document explicitly defines the outcome of an invitation as a user object with the type "Guest".

Source: Microsoft Documentation

Azure Active Directory > External Identities > User properties > Properties of a B2B guest user

"Before and after invitation" section.