Explanation

Explanation
* Vendors must be able to authenticate by using their Microsoft account when accessing Contoso resources.
You can invite guest users to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest user must then redeem their invitation to access resources. An invitation of a user does not expire.
The invitation will include a link to create a Microsoft account. The user can then authenticate using their Microsoft account. In this question, the vendors already have Microsoft accounts so they can authenticate using them.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/b2b/add-users-administrator

Explanation

References:
https://docs.microsoft.com/en-us/office365/securitycompliance/retention-policies#the-principles-of-retention-or-

Explanation

References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad

Reference:
https://support.office.com/en-gb/article/what-do-domain-statuses-mean-in-office-365-3ecf1fef-3b31-497c-98bc-e57e2413b4e5