Question

Contoso is acquiring Fabrikam, which operates in a separate Microsoft Entra tenant. Fabrikam employees (guest users invited via B2B) must access Contoso's Azure resources. Contoso already enforces MFA through Conditional Access. To avoid forcing Fabrikam users to re-register for MFA in Contoso's tenant while still requiring MFA, which approach should you recommend?

Accepted Answer

Configure cross-tenant access settings inbound trust to accept MFA claims from Fabrikam's home tenant.

Answer

Exclude all guest users from Contoso's Conditional Access MFA policy.

Answer

Create a separate Contoso account for each Fabrikam user and enforce MFA registration during onboarding.

Answer

Configure Contoso's Conditional Access policy to require a compliant device for all guest sign-ins.