The correct option is Automatically provision guest accounts from a third party identity provider.

This task is not something the Contoso Identity admin portal performs directly because automatic provisioning from an external identity provider normally requires a provisioning connector or SCIM integration and often must be configured in the external IdP or a provisioning service rather than through the portal's manual user management UI. The portal supports managing invited and existing guest accounts but it does not replace the external provisioning workflow that automatically creates guest identities from a third party system.

Send an invitation to add an external guest account is incorrect because inviting guests is a standard, built in capability of the admin portal and administrators can send invitations to external users directly from the user management interface.

Enable multifactor authentication for external guest accounts is incorrect because MFA requirements for guest users can be enforced from the portal through authentication settings and conditional access policies that apply to external accounts.

Promote a guest account to a regular member account is incorrect because the admin portal allows changing a user's account type or converting a guest to a member through the user properties and account management features.

Full AWS Practitioner Certification Question