Your company, Contoso, is partnering with an external vendor, Fabrikam. A Fabrikam consultant named Sara needs to access a specific resource group in Contoso's Azure subscription for the next three months. Sara already has a Microsoft Entra account at fabrikam.com. You want Sara to authenticate with her existing Fabrikam credentials while you control her access to Contoso resources. What should you do first in the Contoso tenant?