Guest contractor had signed up for the Exchange admin center

[avrohomdu]

“Category: SC-300 – Plan and Automate Identity Governance

You manage a Microsoft 365 tenant that uses Microsoft Entra ID for identity and access management. The Sign-in activity report recently revealed that a guest contractor had signed up for the Exchange admin center.

To strengthen security, your manager suggests implementing Conditional Access policies to control guest sign-ins. However, your compliance team requires a recurring monthly review of guest access to the Exchange admin center, and mandates that any guest user who fails the review must be blocked from signing in.

Which solution should you implement to meet the compliance requirement?”

The given answer is “An access review of groups where guest accounts are members.”

The question doesn’t mention anything about a group, and also “signed up for the Exchange admin center” doesn’t make sense. That’s not a thing.

I’m assuming from the explanation that there’s a group that has the exchange admin role assigned to it and this guest tried to join the group via PIM? The question does not mention anything about that, so I think from the words of the question the correct answer is an access review of all guests in the tenant.

[Ace-TutorialsDojo]

Hello, Avrohomdu.

Thank you for your insightful feedback. You are absolutely right, the phrase “signed up for the Exchange admin center” is unclear and not how access is typically granted. Access to the Exchange admin center is usually controlled via role assignments or group memberships. To reflect this more accurately, the phrase should be reworded to something like “a guest contractor was granted access to the Exchange admin center.”

Additionally, you’ve raised a valid point about the access review of groups. Since the question does not explicitly mention group memberships, the compliance requirement could indeed be interpreted as needing a broader access review of all guest users in the tenant. If access is not group-based, an alternative solution could be to review all guest users across the tenant.

We appreciate your observation, and we will address this issue to ensure the scenario is more clearly aligned with the intended solution. Thanks again for your helpful feedback!

Regards,

Ace @ Tutorials Dojo