Microsoft AZ-500

Incorrect. Inbound access settings in Cross-tenant access settings control how users from fabrikam.com can access resources in contoso.com. That is the opposite direction from the requirement, which is about contoso.com users using apps from fabrikam.com. In addition, B2B direct connect is intended for direct federation-style collaboration scenarios such as Teams shared channels, not for maintaining an allow list of cloud applications. It does not provide the requested external app allow-list behavior.

Correct. External collaboration settings include Collaboration restrictions, which are used to define an allow list or block list of external applications that users in the tenant can access. This directly satisfies the requirement to permit only approved cloud apps from fabrikam.com for users in contoso.com. The setting is designed for app-level governance of external collaboration rather than invitation workflow or tenant trust configuration. It is the most precise administrative control for limiting external app usage to approved applications.

Incorrect. Guest invite settings determine who in contoso.com can invite guest users and under what conditions. These settings govern the invitation process and guest onboarding permissions, not which external cloud applications users are allowed to access. They do not create an allow list of partner applications. Therefore, this option does not address the app access control requirement.

Incorrect. Outbound access settings in Cross-tenant access settings govern how contoso.com users can access resources in an external tenant such as fabrikam.com, but they are focused on cross-tenant B2B trust and access behavior rather than maintaining an allow list of cloud apps. B2B collaboration settings there are used for tenant-to-tenant collaboration policy, not for the specific external application allow-list control asked in the question. The exam distinction is that app allow/block lists are configured under External collaboration settings via Collaboration restrictions. Choosing outbound access is a common confusion because the direction seems right, but the feature scope is wrong.