MD-102 Manage identity and compliance — 10 Questions

Question 1

A company with 500 users uses Microsoft 365 E3 licenses. They want to ensure that all users have multi-factor authentication (MFA) enforced. Currently, 80% of users have MFA enabled through the legacy per-user MFA setting. The security team wants to use Conditional Access policies instead. You need to migrate from per-user MFA to Conditional Access with no disruption to users. What should you do?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding break-glass accounts. Disable per-user MFA for all users.. Option C is correct because you need to exclude the break-glass accounts from the Conditional Access policy to ensure admin access if something goes wrong. You should first create a Conditional Access policy that requires MFA for all users except the break-glass accounts, then disable the per-user MFA for all users. Option A is incorrect because disabling per-user MFA before creating the policy would leave users without MFA. Option B is incorrect because using a Conditional Access policy to require MFA from outside the network only would not enforce MFA for internal access. Option D is incorrect because creating a policy without excluding break-glass accounts could lock out administrators.

Answer

Create a Conditional Access policy requiring MFA for all cloud apps, including break-glass accounts. Then disable per-user MFA.

Answer

Create a Conditional Access policy requiring MFA for all users only when accessing from outside the corporate network.

Answer

Disable per-user MFA for all users, then create a Conditional Access policy requiring MFA for all cloud apps.

Question 2

You are an endpoint administrator for a company that uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access Exchange Online. You have configured a Conditional Access policy that grants access to Exchange Online only if the device is marked as compliant. A user reports that they cannot access email from their iOS device, which is enrolled in Intune and shows as compliant. The user can access other Microsoft 365 services. What is the most likely cause?

Accepted Answer

The Exchange Online workload is not enabled in Intune for mobile device management.. The most likely cause is that the Exchange Online workload is not enabled in Intune for mobile device management (MDM). Even though the device is enrolled and compliant, Intune must have the Exchange Online workload enabled to apply Conditional Access policies that govern email access. Without this, the Conditional Access policy cannot enforce compliance checks specifically for Exchange Online, resulting in access being blocked despite the device showing as compliant.

Answer

The user does not have an Exchange Online license assigned.

Answer

The Conditional Access policy is configured to block access from non-corporate networks.

Answer

The device compliance policy is not set to require a PIN or password.

Question 3

A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Azure AD Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?

Accepted Answer

An enterprise certification authority (CA) must be deployed and all devices must be Azure AD joined or hybrid Azure AD joined.. Certificate-based Windows Hello for Business requires an enterprise PKI to issue and validate certificates for authentication. Devices must be Azure AD joined or hybrid Azure AD joined to enroll these certificates and support the certificate trust model. On-premises Active Directory and Azure AD Connect provide the hybrid identity foundation, but the CA and appropriate device join state are the critical prerequisites.

Answer

All users must have the Microsoft Authenticator app installed.

Answer

Conditional Access policies must be configured to require Windows Hello for Business.

Answer

All users must be configured for passwordless sign-in.

Question 4

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Accepted Answer

Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.. Option B is correct because the Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.

Answer

Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.

Answer

Exclude all users who have not registered for MFA from the Conditional Access policy.

Answer

Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.

Question 5

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices that have a BitLocker encryption status of 'fully encrypted' are allowed to access corporate resources. They create a device compliance policy that requires BitLocker. However, some devices are still accessing resources even though they are not fully encrypted. What should you check?

Accepted Answer

The compliance policy is not assigned to the user or device groups.. Option B is correct because a device compliance policy must be assigned to the appropriate user or device groups to take effect. If the policy is not assigned, Intune will not evaluate the devices against the BitLocker requirement, and non-compliant devices will continue to access corporate resources. The scenario indicates that the policy was created but not enforced, which points directly to a missing assignment.

Answer

The devices are running Windows 10 Home edition, which does not support BitLocker.

Answer

The compliance policy is set to 'Report non-compliant' instead of 'Block non-compliant'.

Answer

The compliance policy has a grace period configured that allows access for non-compliant devices.

Question 6

Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?

Accepted Answer

Windows 10 devices that are domain-joined to the on-premises Active Directory.. Option B is correct because Azure AD Join in a hybrid environment requires devices to be domain-joined to on-premises Active Directory first. This allows Azure AD Connect to synchronize the device objects and, with device writeback enabled, register them in Azure AD, enabling seamless single sign-on and conditional access.

Answer

Active Directory Federation Services (AD FS) deployed.

Answer

Azure AD Premium P1 licenses for all users.

Answer

Windows Hello for Business configured for all users.

Question 7

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Accepted Answer

Assign the policy to a user group, which applies to devices enrolled by those users.. Option A is correct because Microsoft Intune compliance policies can be assigned to user groups, and when a user in the group enrolls a device, the policy applies to that device. This is the most common deployment method, leveraging user-based targeting to ensure compliance settings are enforced on devices associated with those users.

Answer

Assign the policy directly to individual devices from the Intune console.

Answer

Assign the policy to a device category.

Question 8

Refer to the exhibit. The JSON snippet shows the Azure AD Identity Protection MFA registration policy configuration for the Contoso tenant. A new user, Jane, joins the company and is assigned a license. Jane attempts to access the Azure portal and is prompted to register for MFA. She registers successfully. However, the next day, she is again prompted to register for MFA. What is the most likely cause?

Accepted Answer

The user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory.. The most likely cause is that the user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory. When Azure AD Connect synchronizes a user object from on-premises AD, it can overwrite the cloud MFA registration state if the on-premises attribute (such as 'StrongAuthenticationMethods' or 'StrongAuthenticationTime') is not set or is reset. This causes the user to be treated as unregistered, prompting MFA registration again despite a previous successful registration.

Answer

The MFA registration policy is disabled.

Answer

The policy is not including all users.

Answer

The policy excludes the user Jane.

Question 9

Refer to the exhibit. A Windows 10 device is showing as non-compliant. The compliance policy 'Require BitLocker' is assigned to all devices. The device does not have BitLocker enabled. However, the user is able to access corporate email on the device. What is the most likely reason for this?

Accepted Answer

There is no Conditional Access policy that requires compliant device for access to corporate email.. D is correct because compliance policies alone do not enforce access restrictions; they only report device compliance status. To block access to corporate email, a Conditional Access policy must be configured to require a compliant device. Without such a policy, the device can still access email even if it is non-compliant.

Answer

The compliance policy has a grace period of 7 days for BitLocker.

Answer

The compliance policy is not assigned to the device.

Answer

The device is configured as a kiosk device, which exempts it from compliance.

Question 10

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing the company's SaaS applications. However, they need to exclude a group of service accounts that use legacy authentication protocols. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, and excluding the service accounts group.. Option C is correct because Conditional Access is the recommended method for granular MFA enforcement in Microsoft Entra ID P1. It allows you to target all cloud apps (including SaaS applications) with a 'Require MFA' grant control and exclude a specific group of service accounts. This approach supports legacy authentication protocols by excluding those accounts, while Security defaults or per-user MFA would either block legacy auth or lack the necessary exclusion granularity.

Answer

Enable Security defaults and add the service accounts group to the excluded users list.

Answer

Assign the 'Require MFA' baseline policy and exclude the service accounts group.

Answer

Enable per-user MFA and exclude the service accounts group.