MD-102 Manage identity and compliance — All Questions With Answers

Question 1

A company with 500 users uses Microsoft 365 E3 licenses. They want to ensure that all users have multi-factor authentication (MFA) enforced. Currently, 80% of users have MFA enabled through the legacy per-user MFA setting. The security team wants to use Conditional Access policies instead. You need to migrate from per-user MFA to Conditional Access with no disruption to users. What should you do?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding break-glass accounts. Disable per-user MFA for all users.. Option C is correct because you need to exclude the break-glass accounts from the Conditional Access policy to ensure admin access if something goes wrong. You should first create a Conditional Access policy that requires MFA for all users except the break-glass accounts, then disable the per-user MFA for all users. Option A is incorrect because disabling per-user MFA before creating the policy would leave users without MFA. Option B is incorrect because using a Conditional Access policy to require MFA from outside the network only would not enforce MFA for internal access. Option D is incorrect because creating a policy without excluding break-glass accounts could lock out administrators.

Answer

Create a Conditional Access policy requiring MFA for all cloud apps, including break-glass accounts. Then disable per-user MFA.

Answer

Create a Conditional Access policy requiring MFA for all users only when accessing from outside the corporate network.

Answer

Disable per-user MFA for all users, then create a Conditional Access policy requiring MFA for all cloud apps.

Question 2

You are an endpoint administrator for a company that uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access Exchange Online. You have configured a Conditional Access policy that grants access to Exchange Online only if the device is marked as compliant. A user reports that they cannot access email from their iOS device, which is enrolled in Intune and shows as compliant. The user can access other Microsoft 365 services. What is the most likely cause?

Accepted Answer

The Exchange Online workload is not enabled in Intune for mobile device management.. The most likely cause is that the Exchange Online workload is not enabled in Intune for mobile device management (MDM). Even though the device is enrolled and compliant, Intune must have the Exchange Online workload enabled to apply Conditional Access policies that govern email access. Without this, the Conditional Access policy cannot enforce compliance checks specifically for Exchange Online, resulting in access being blocked despite the device showing as compliant.

Answer

The user does not have an Exchange Online license assigned.

Answer

The Conditional Access policy is configured to block access from non-corporate networks.

Answer

The device compliance policy is not set to require a PIN or password.

Question 3

A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Azure AD Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?

Accepted Answer

An enterprise certification authority (CA) must be deployed and all devices must be Azure AD joined or hybrid Azure AD joined.. Certificate-based Windows Hello for Business requires an enterprise PKI to issue and validate certificates for authentication. Devices must be Azure AD joined or hybrid Azure AD joined to enroll these certificates and support the certificate trust model. On-premises Active Directory and Azure AD Connect provide the hybrid identity foundation, but the CA and appropriate device join state are the critical prerequisites.

Answer

All users must have the Microsoft Authenticator app installed.

Answer

Conditional Access policies must be configured to require Windows Hello for Business.

Answer

All users must be configured for passwordless sign-in.

Question 4

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Accepted Answer

Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.. Option B is correct because the Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.

Answer

Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.

Answer

Exclude all users who have not registered for MFA from the Conditional Access policy.

Answer

Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.

Question 5

A company uses Microsoft Intune to manage Windows 10 devices. They need to ensure that only devices that have a BitLocker encryption status of 'fully encrypted' are allowed to access corporate resources. They create a device compliance policy that requires BitLocker. However, some devices are still accessing resources even though they are not fully encrypted. What should you check?

Accepted Answer

The compliance policy is not assigned to the user or device groups.. Option B is correct because a device compliance policy must be assigned to the appropriate user or device groups to take effect. If the policy is not assigned, Intune will not evaluate the devices against the BitLocker requirement, and non-compliant devices will continue to access corporate resources. The scenario indicates that the policy was created but not enforced, which points directly to a missing assignment.

Answer

The devices are running Windows 10 Home edition, which does not support BitLocker.

Answer

The compliance policy is set to 'Report non-compliant' instead of 'Block non-compliant'.

Answer

The compliance policy has a grace period configured that allows access for non-compliant devices.

Question 6

Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?

Accepted Answer

Windows 10 devices that are domain-joined to the on-premises Active Directory.. Option B is correct because Azure AD Join in a hybrid environment requires devices to be domain-joined to on-premises Active Directory first. This allows Azure AD Connect to synchronize the device objects and, with device writeback enabled, register them in Azure AD, enabling seamless single sign-on and conditional access.

Answer

Active Directory Federation Services (AD FS) deployed.

Answer

Azure AD Premium P1 licenses for all users.

Answer

Windows Hello for Business configured for all users.

Question 7

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Accepted Answer

Assign the policy to a user group, which applies to devices enrolled by those users.. Option A is correct because Microsoft Intune compliance policies can be assigned to user groups, and when a user in the group enrolls a device, the policy applies to that device. This is the most common deployment method, leveraging user-based targeting to ensure compliance settings are enforced on devices associated with those users.

Answer

Assign the policy directly to individual devices from the Intune console.

Answer

Assign the policy to a device category.

Question 8

Refer to the exhibit. The JSON snippet shows the Azure AD Identity Protection MFA registration policy configuration for the Contoso tenant. A new user, Jane, joins the company and is assigned a license. Jane attempts to access the Azure portal and is prompted to register for MFA. She registers successfully. However, the next day, she is again prompted to register for MFA. What is the most likely cause?

Accepted Answer

The user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory.. The most likely cause is that the user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory. When Azure AD Connect synchronizes a user object from on-premises AD, it can overwrite the cloud MFA registration state if the on-premises attribute (such as 'StrongAuthenticationMethods' or 'StrongAuthenticationTime') is not set or is reset. This causes the user to be treated as unregistered, prompting MFA registration again despite a previous successful registration.

Answer

The MFA registration policy is disabled.

Answer

The policy is not including all users.

Answer

The policy excludes the user Jane.

Question 9

Refer to the exhibit. A Windows 10 device is showing as non-compliant. The compliance policy 'Require BitLocker' is assigned to all devices. The device does not have BitLocker enabled. However, the user is able to access corporate email on the device. What is the most likely reason for this?

Accepted Answer

There is no Conditional Access policy that requires compliant device for access to corporate email.. D is correct because compliance policies alone do not enforce access restrictions; they only report device compliance status. To block access to corporate email, a Conditional Access policy must be configured to require a compliant device. Without such a policy, the device can still access email even if it is non-compliant.

Answer

The compliance policy has a grace period of 7 days for BitLocker.

Answer

The compliance policy is not assigned to the device.

Answer

The device is configured as a kiosk device, which exempts it from compliance.

Question 10

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing the company's SaaS applications. However, they need to exclude a group of service accounts that use legacy authentication protocols. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy targeting all cloud apps, requiring MFA, and excluding the service accounts group.. Option C is correct because Conditional Access is the recommended method for granular MFA enforcement in Microsoft Entra ID P1. It allows you to target all cloud apps (including SaaS applications) with a 'Require MFA' grant control and exclude a specific group of service accounts. This approach supports legacy authentication protocols by excluding those accounts, while Security defaults or per-user MFA would either block legacy auth or lack the necessary exclusion granularity.

Answer

Enable Security defaults and add the service accounts group to the excluded users list.

Answer

Assign the 'Require MFA' baseline policy and exclude the service accounts group.

Answer

Enable per-user MFA and exclude the service accounts group.

Question 11

An organization has deployed Microsoft Entra Connect Sync to synchronize on-premises Active Directory to Microsoft Entra ID. Users report that some cloud-only user accounts cannot be assigned licenses. The admin checks the provisioning logs and finds that the cloud accounts have a source of authority of 'Microsoft Entra ID'. What is the most likely cause?

Accepted Answer

The accounts are missing the 'UsageLocation' attribute, which is required for license assignment.. The most likely cause is that the cloud-only user accounts are missing the 'UsageLocation' attribute. In Microsoft Entra ID, a UsageLocation must be set before licenses can be assigned to any user, including cloud-only accounts. Without this attribute, license assignment fails regardless of the user's source of authority.

Answer

The accounts have the 'cloudOnly' attribute set to true, which blocks license assignment.

Answer

The accounts have no proxyAddresses, so licensing fails.

Answer

The users are not synchronized because the sync schedule is set to manual.

Question 12

A company is planning to implement Microsoft Intune for mobile device management. They want to ensure that only compliant devices can access Exchange Online. Which technology should they use?

Accepted Answer

Conditional Access policies with device compliance. Conditional Access policies with device compliance (Option D) is the correct technology because it integrates Intune compliance policies with Azure AD Conditional Access to enforce access controls on Exchange Online. When a device is marked non-compliant by Intune, Conditional Access blocks or restricts access to Exchange Online, ensuring only compliant devices can connect. This is the standard Microsoft approach for combining device management with identity-driven access control.

Answer

Mobile Application Management (MAM) policies

Answer

Intune compliance policies without Conditional Access

Answer

Azure AD join with automatic enrollment

Question 13

An administrator is configuring Microsoft Entra ID Protection. They want to create a policy that automatically blocks sign-ins when the risk level is high. However, they notice that the policy is not triggering for some users who have high risk. What is the most likely reason?

Accepted Answer

The user risk policy is set to 'Report-only' mode instead of 'On'.. Option C is correct because when a user risk policy is set to 'Report-only' mode, it evaluates risk and generates reports but does not enforce any actions such as blocking sign-ins. For automatic blocking to occur, the policy must be set to 'On' (enabled). The administrator likely configured the policy correctly in terms of risk level but overlooked the enforcement mode, which is a common misconfiguration in Microsoft Entra ID Protection.

Answer

The sign-in risk policy is overriding the user risk policy.

Answer

The users have MFA enabled, so they are exempt from risk policies.

Answer

The policy is configured to apply only to a test group, and the affected users are not members.

Question 14

A company uses Microsoft 365 E3 licenses. They need to enforce that all users must use the Microsoft Authenticator app for MFA instead of SMS or phone call. What should the administrator configure?

Accepted Answer

Authentication methods policy. The Authentication methods policy (B) is the correct configuration because it allows administrators to control exactly which authentication methods users can register and use for MFA. By targeting the policy to all users and disabling SMS and voice call while enabling Microsoft Authenticator (push notifications or OTP), the requirement is met. This policy supersedes legacy MFA settings and provides granular control over modern authentication methods.

Answer

MFA service settings in the legacy portal

Answer

Security defaults

Answer

Conditional Access policy

Question 15

A company uses Microsoft Intune to manage Windows 10 devices. They want to ensure that devices have BitLocker enabled and are compliant before accessing corporate resources. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Create a device compliance policy that requires BitLocker.. Option B is correct because a device compliance policy in Microsoft Intune can include the setting to require BitLocker on Windows 10 devices. This policy evaluates the device's BitLocker status and marks it as noncompliant if BitLocker is not enabled, which is a prerequisite for Conditional Access to block access to corporate resources.

Answer

Assign the device compliance policy to all users.

Answer

Enable Windows Hello for Business.

Answer

Create a device configuration profile to enable BitLocker.

Question 16

An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)

Accepted Answer

Multi-factor authentication (MFA). Multi-factor authentication (MFA) is essential for a zero-trust architecture because it enforces strong identity verification beyond just a password, ensuring that each authentication request is validated with an additional factor (e.g., a phone call, text message, or authenticator app). This aligns with the zero-trust principle of 'never trust, always verify' by requiring explicit proof of identity at every access attempt, even if the user is inside the corporate network.

Answer

Azure AD Application Proxy

Answer

Azure AD Connect sync

Question 17

Refer to the exhibit. A user attempts to sign in to Microsoft Graph PowerShell and receives the error shown. What is the most likely cause?

Accepted Answer

The user does not have an appropriate Microsoft Entra ID license assigned.. The error shown indicates that the user lacks the required license for Microsoft Entra ID (formerly Azure AD) features needed to sign in to Microsoft Graph PowerShell. Microsoft Graph PowerShell requires an appropriate Microsoft Entra ID license (such as Premium P1 or P2) to access directory-level APIs and authentication methods. Without this license, the service cannot validate the user's identity for Graph API calls, resulting in the sign-in failure.

Answer

The user is not registered for MFA.

Answer

The device is not registered in Microsoft Entra ID.

Answer

The sign-in was blocked by a Conditional Access policy.

Question 18

A company uses Microsoft 365 with hybrid identity. Users report that after changing their on-premises passwords, they cannot access SharePoint Online for up to 30 minutes, but Outlook on the web works immediately. You need to reduce the delay for SharePoint Online access. What should you do?

Accepted Answer

Run a Delta Sync in Azure AD Connect.. The delay occurs because password changes are synchronized only during the next Azure AD Connect sync cycle, which by default runs every 30 minutes. Running a Delta Sync immediately replicates the new password hash to Azure AD, eliminating the wait for SharePoint Online authentication.

Answer

Configure password writeback in Azure AD Connect.

Answer

Enable Azure AD Seamless Single Sign-On.

Answer

In Azure AD, configure the user to require password change at next sign-in.

Question 19

A multinational organization uses Microsoft 365 E5 licenses. The compliance officer wants to ensure that all documents containing credit card numbers are automatically classified and protected with a label that applies encryption. You configure auto-labeling policies in Microsoft Purview. After 24 hours, the compliance officer reports that no documents have been labeled. The policy scope is set to 'All locations' and the policy is enabled. What is the most likely cause of the issue?

Accepted Answer

The policy is deployed in simulation mode only.. Auto-labeling policies in Microsoft Purview can be configured in simulation mode, which evaluates documents against the policy rules and reports what would be labeled without actually applying any labels. Since the compliance officer reports that no documents have been labeled after 24 hours, the most likely cause is that the policy is still in simulation mode, which is a common deployment step to validate the policy before turning it on for real labeling.

Answer

No sensitivity labels have been published to the users.

Answer

Auto-labeling requires Azure Information Protection (AIP) add-on license.

Answer

The priority of the policy is too low compared to other policies.

Question 20

You are configuring Microsoft Entra Conditional Access for a company that requires all employees to use multi-factor authentication (MFA) when accessing the Azure portal. The company also wants to block access from devices that are not compliant. You create a Conditional Access policy. Which two assignments must you configure to meet these requirements? (Choose two.)

Accepted Answer

Grant access, require multi-factor authentication. Option C is correct because the requirement to enforce multi-factor authentication (MFA) for Azure portal access is met by configuring the 'Grant' control to 'Require multi-factor authentication'. Option D is correct because blocking access from non-compliant devices is achieved by selecting 'Require device to be marked as compliant' under Grant controls, which ensures only devices that meet compliance policies (e.g., Intune-managed) are allowed. Both assignments are necessary to satisfy the two distinct requirements.

Answer

Grant access, require Microsoft Entra hybrid joined device

Answer

Grant access, block access for non-compliant devices

MD-102 Manage identity and compliance — All Questions With Answers

A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Azure AD Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Exhibit

Refer to the exhibit. A Windows 10 device is showing as non-compliant. The compliance policy 'Require BitLocker' is assigned to all devices. The device does not have BitLocker enabled. However, the user is able to access corporate email on the device. What is the most likely reason for this?

Exhibit

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing the company's SaaS applications. However, they need to exclude a group of service accounts that use legacy authentication protocols. What is the recommended approach?

A company is planning to implement Microsoft Intune for mobile device management. They want to ensure that only compliant devices can access Exchange Online. Which technology should they use?

An administrator is configuring Microsoft Entra ID Protection. They want to create a policy that automatically blocks sign-ins when the risk level is high. However, they notice that the policy is not triggering for some users who have high risk. What is the most likely reason?

A company uses Microsoft 365 E3 licenses. They need to enforce that all users must use the Microsoft Authenticator app for MFA instead of SMS or phone call. What should the administrator configure?

A company uses Microsoft Intune to manage Windows 10 devices. They want to ensure that devices have BitLocker enabled and are compliant before accessing corporate resources. Which TWO actions should the administrator take? (Choose two.)

An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)

Refer to the exhibit. A user attempts to sign in to Microsoft Graph PowerShell and receives the error shown. What is the most likely cause?

Exhibit

A company uses Microsoft 365 with hybrid identity. Users report that after changing their on-premises passwords, they cannot access SharePoint Online for up to 30 minutes, but Outlook on the web works immediately. You need to reduce the delay for SharePoint Online access. What should you do?

You are a Teams administrator. After running the PowerShell script shown in the exhibit, users report they cannot communicate with federated users from 'trusted.com'. What is the most likely cause?

Exhibit

Order the steps for configuring a Windows 10 kiosk device using Assigned Access.

Order the steps to configure Windows Defender Antivirus exclusions via Group Policy.

Order the steps to migrate user profiles from Windows 10 to a new device using User State Migration Tool (USMT).

Match each MDM (Mobile Device Management) enrollment method to its typical scenario.

Match each Microsoft Entra ID (Azure AD) join type to its description.

Match each Microsoft 365 compliance feature to its description.

MD-102 Manage identity and compliance — All Questions With Answers

A company is implementing Windows Hello for Business and wants to use certificate-based authentication. They have an on-premises Active Directory and are using Azure AD Connect for hybrid identity. Which prerequisites must be met to support certificate-based Windows Hello for Business?

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

Which TWO of the following are required to implement Azure AD Join for Windows 10 devices in a hybrid environment with on-premises Active Directory?

Which THREE of the following are valid methods for deploying Microsoft Intune compliance policies to devices?

Exhibit

Refer to the exhibit. A Windows 10 device is showing as non-compliant. The compliance policy 'Require BitLocker' is assigned to all devices. The device does not have BitLocker enabled. However, the user is able to access corporate email on the device. What is the most likely reason for this?

Exhibit

A company uses Microsoft Entra ID P1 licenses. They want to enforce multi-factor authentication (MFA) for all users accessing the company's SaaS applications. However, they need to exclude a group of service accounts that use legacy authentication protocols. What is the recommended approach?

A company is planning to implement Microsoft Intune for mobile device management. They want to ensure that only compliant devices can access Exchange Online. Which technology should they use?

An administrator is configuring Microsoft Entra ID Protection. They want to create a policy that automatically blocks sign-ins when the risk level is high. However, they notice that the policy is not triggering for some users who have high risk. What is the most likely reason?

A company uses Microsoft 365 E3 licenses. They need to enforce that all users must use the Microsoft Authenticator app for MFA instead of SMS or phone call. What should the administrator configure?

A company uses Microsoft Intune to manage Windows 10 devices. They want to ensure that devices have BitLocker enabled and are compliant before accessing corporate resources. Which TWO actions should the administrator take? (Choose two.)

An organization is planning to implement a zero-trust security model. They need to evaluate the following capabilities in Microsoft 365. Which THREE are essential for a zero-trust architecture? (Choose three.)

Refer to the exhibit. A user attempts to sign in to Microsoft Graph PowerShell and receives the error shown. What is the most likely cause?

Exhibit

A company uses Microsoft 365 with hybrid identity. Users report that after changing their on-premises passwords, they cannot access SharePoint Online for up to 30 minutes, but Outlook on the web works immediately. You need to reduce the delay for SharePoint Online access. What should you do?

You are a Teams administrator. After running the PowerShell script shown in the exhibit, users report they cannot communicate with federated users from 'trusted.com'. What is the most likely cause?

Exhibit

Order the steps for configuring a Windows 10 kiosk device using Assigned Access.

Order the steps to configure Windows Defender Antivirus exclusions via Group Policy.

Order the steps to migrate user profiles from Windows 10 to a new device using User State Migration Tool (USMT).

Match each MDM (Mobile Device Management) enrollment method to its typical scenario.

Match each Microsoft Entra ID (Azure AD) join type to its description.

Match each Microsoft 365 compliance feature to its description.