Azure AD tenants and directories - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Azure AD Tenant Isolation

Which statement best describes the isolation between two Azure AD tenants?

A Users and resources in one tenant cannot access resources in another tenant without explicit guest invitations.

B Users in one tenant can access resources in another tenant by default if they share the same domain name.

C All tenants under the same Azure subscription share the same user directory automatically.

D Tenants are isolated only at the subscription level but share user identities across tenants.

💡 Hint

Think about how Azure AD controls access across different organizations.

Azure AD tenants are separate directories. Users in one tenant cannot access another tenant's resources unless invited as guests.

❓ Architecture

intermediate

Choosing the Right Azure AD Tenant for a Multi-Region Company

A company operates in multiple countries and wants to centralize user management while complying with data residency laws. Which Azure AD tenant strategy is best?

A Create a single Azure AD tenant for all regions and use conditional access policies to restrict data access by location.

B Create separate Azure AD tenants for each country and do not link them to maintain data residency compliance.

C Use one tenant per region but synchronize users across tenants using Azure AD Connect.

D Use multiple tenants but merge them into one tenant monthly to centralize user data.

💡 Hint

Consider how Azure AD supports centralized management and compliance controls.

A single tenant with conditional access allows centralized management and enforces location-based policies to meet residency laws.

❓ security

advanced

Impact of Guest User Invitations on Azure AD Tenant Security

What is the primary security risk when inviting guest users from external organizations into your Azure AD tenant?

A Guest users gain full administrative rights by default in the host tenant.

B Guest users can delete the host tenant's directory if invited incorrectly.

C Guest users automatically synchronize their credentials with the host tenant's directory.

D Guest users can access resources beyond what is explicitly shared if permissions are not carefully managed.

💡 Hint

Think about permission boundaries and sharing controls.

Guest users only have access to resources shared with them, but improper permission management can lead to overexposure.

❓ service_behavior

advanced

Azure AD Tenant Behavior on Subscription Transfer

What happens to the Azure AD tenant association when an Azure subscription is transferred from one tenant to another?

A The subscription remains linked to the original tenant, and transfer is not possible.

B The subscription moves to the new tenant, and all users from the old tenant lose access immediately.

C The subscription is associated with the new tenant, but users from the old tenant retain access until explicitly removed.

D The subscription is deleted and must be recreated under the new tenant.

💡 Hint

Consider how Azure manages user access during subscription transfers.

When a subscription is transferred, it associates with the new tenant, but user access from the old tenant continues until changed.

✅ Best Practice

expert

Best Practice for Managing Multiple Azure AD Tenants in a Large Organization

In a large organization with multiple Azure AD tenants, what is the best practice to ensure secure and efficient user access management?

A Manually create duplicate user accounts in each tenant to maintain separation and avoid cross-tenant access.

B Use Azure AD B2B collaboration to invite users across tenants and manage access centrally with role-based access control (RBAC).

C Merge all tenants into one tenant regardless of organizational boundaries to simplify management.

D Disable guest access and require users to switch tenants manually to access resources.

💡 Hint

Think about how Azure AD supports collaboration and access control across tenants.

Azure AD B2B collaboration with RBAC allows secure, centralized management of users across multiple tenants without duplication.