Contoso is partnering with an external marketing agency. The agency's employees need to access a shared SharePoint site and a few internal Teams channels using their own company credentials, without Contoso creating and managing new passwords for them. Which Microsoft Entra identity type should Contoso use to grant this access?