You must grant a partner organization’s users access to a Microsoft Teams team, a SharePoint site, and an internal line-of-business app. Requirements: requests require approval by a Contoso sponsor, assignments expire after 60 days if not renewed, access is available only to users from the partner’s verified domain, and external guest accounts should be removed from the tenant when they lose all assignments. What should you implement? (Choose two)

Implementing a connected organization for the partner domain (configured for Contoso sponsorship) is crucial because it establishes the trusted relationship and allows Contoso to manage access requests from that specific partner. This directly addresses the requirement for access only from the partner's verified domain and lays the groundwork for sponsor approval. Creating an access package with the specified resources (Team, SharePoint site, app roles) and a policy that includes sponsor approval, 60-day expiration with renewal, and removal of external users when they have no assignments, directly fulfills all remaining requirements. Access packages are designed for managing external user access to multiple resources with granular control over lifecycle and approval workflows. Inviting users directly to the Team and SharePoint site using guest sharing would not provide the centralized management, sponsor approval, automatic expiration, or removal of external accounts required. Azure AD PIM for groups is for just-in-time access for internal users, not for managing external partner access lifecycle. A Conditional Access policy can block access but doesn't manage the entire lifecycle of external user accounts, including sponsorship, expiration, and removal.