SC-300 Certification Practice Question #49

Question

You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.

Several users use their contoso.com email address for self-service sign-up to Azure AD.

You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.

You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.

Which PowerShell cmdlet should you run?

Accepted Answer

The scenario — users self-service signing up to a tenant because their contoso.com address matches a verified domain — is exactly the "email-verified users joining the organization" control. Per MS Learn, the documented cmdlet is actually `Update-MgPolicyAuthorizationPolicy` with `allowEmailVerifiedUsersToJoinOrganization = $false`, which is **not** in the option list. Among the four choices, only A (`Update-MgOrganization`) is a real organization-level settings cmdlet and is the overwhelming community pick (26 votes) and the official Suggested Answer; B is widely noted as not a valid cmdlet, while C and D target unrelated domain/federation properties. Confidence is held at 78% because the doc-perfect cmdlet isn't offered, so A is the "best available" answer rather than a literal documentation match, and a minority insisted on B.

More SC-300 practice questions