MS-102 Implement and manage Microsoft Entra identity and access — 25 Questions

Question 1

A company uses Microsoft Entra ID for identity management. The security team wants to ensure that users cannot register applications in the tenant to prevent potential data leakage. Which setting should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set 'Users can register applications' to 'No' in User settings. Setting 'Users can register applications' to 'No' in the Microsoft Entra ID User settings explicitly prevents non-admin users from creating application registrations in the tenant. This directly addresses the security team's goal of blocking users from registering apps, which could otherwise expose tenant data through misconfigured or malicious applications.

Answer

Set the 'Admin consent requests' setting to 'Allow'

Answer

Enable the 'Admin consent workflow'

Answer

Set 'Users can consent to apps accessing company data' to 'No'

Question 2

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use their existing on-premises passwords to log in to cloud services, while maintaining password policy enforcement on-premises. Which feature should you implement?

Accepted Answer

Pass-through Authentication with Seamless SSO. Pass-through Authentication (PTA) validates passwords directly against on-premises Active Directory, ensuring that on-premises password policies (complexity, expiration, lockout) are enforced for cloud sign-ins. PHS merely synchronizes password hashes to Entra ID and cannot enforce on-premises lockout or account state at authentication time.

Answer

Password Hash Synchronization (PHS)

Answer

Active Directory Federation Services (AD FS)

Answer

Install Azure AD Connect with default settings

Question 3

A multinational company uses Microsoft Entra ID with Conditional Access policies. They have a policy that requires multi-factor authentication (MFA) for all users when accessing the company's custom SaaS application. However, users from the European branch are reporting that they are prompted for MFA every time, even though they have already authenticated via a compliant device. What is the most likely cause?

Accepted Answer

The Conditional Access policy has a session control that requires sign-in frequency. The Conditional Access policy includes a session control that requires sign-in frequency, which forces users to re-authenticate with MFA at a specified interval regardless of device compliance or previous authentication. Even if the device is compliant and the user has already authenticated, the sign-in frequency control overrides session persistence and prompts for MFA again based on the configured time period (e.g., every hour). This explains why European branch users are repeatedly prompted for MFA despite having authenticated via a compliant device.

Answer

The user's device is not marked as compliant

Answer

The user has per-user MFA enabled

Answer

The policy includes a location condition that is not met

Question 4

You are configuring Microsoft Entra ID Protection. You want to automatically respond to a specific risk level by requiring the user to change their password. Which risk policy should you configure?

Accepted Answer

User risk policy. The user risk policy in Microsoft Entra ID Protection can be configured to automatically respond to elevated user risk by requiring a password change. The sign-in risk policy (Option B) typically triggers MFA or blocks access based on sign-in risk, not user risk. The session risk policy (Option C) is not a standard risk policy. The MFA registration policy (Option A) is unrelated to risk-based password changes. Therefore, the correct policy for requiring a password change based on user risk is the user risk policy.

Answer

MFA registration policy

Answer

Sign-in risk policy

Answer

Session risk policy

Question 5

An organization is implementing Microsoft Entra Verified ID for verifiable credentials. They want to issue credentials to employees that can be used to prove employment status to third parties. Which component must be created first?

Accepted Answer

A credential manifest in the Microsoft Entra admin center. The credential manifest defines the rules for issuing a verifiable credential, including the claims schema, display information, and issuance policies. In Microsoft Entra Verified ID, you must create the credential manifest in the Entra admin center before any credentials can be issued, as it serves as the template that governs the credential's structure and validation. Without a manifest, there is no definition for what the credential contains or how it should be presented.

Answer

A presentation request policy

Answer

A distributed ledger network

Answer

A decentralized identifier (DID) for the organization

Question 6

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Accepted Answer

Deploy Azure AD Connect cloud sync. Azure AD Connect cloud sync can be configured to synchronize the on-premises Active Directory 'userAccountControl' attribute, which includes the 'ACCOUNTDISABLE' flag. When an on-premises user account is disabled, this flag changes, and cloud sync can trigger a block on the corresponding cloud user's sign-in within a few minutes (typically under 5 minutes) due to its near-real-time sync cycle. This meets the requirement without relying on the slower default sync interval of Azure AD Connect.

Answer

Enable password writeback

Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute

Answer

Configure Microsoft Entra Connect Sync to use filtered synchronization

Question 7

A company uses Microsoft Entra ID and has enabled self-service password reset (SSPR). Users are required to register for SSPR. Management wants to ensure that users from the HR department, who handle sensitive data, must use two methods for authentication during SSPR, while other users can use one method. What is the best way to achieve this?

Accepted Answer

This is not possible because SSPR authentication method requirements are tenant-wide. SSPR authentication method requirements in Microsoft Entra ID are configured at the tenant level, not per user or group. This means you cannot specify that one group of users must use two methods while others use one; the number of methods required applies uniformly to all users enabled for SSPR. Therefore, option D is correct because the requirement cannot be differentiated by department or group.

Answer

Create a separate SSPR policy for the HR department using PowerShell

Answer

Use Microsoft Entra ID Governance to create an access package that requires two methods

Answer

Assign the HR users to a group and configure the SSPR policy for that group in the Entra admin center

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You want to set up a policy that automatically suspends a user if they download more than 100 files from SharePoint Online within 10 minutes. Which type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors user activities across connected apps and can trigger automated actions, such as suspending a user, when a specific threshold of downloads from SharePoint Online is exceeded within a defined time window. This policy type is designed to detect anomalous behavior patterns like mass file downloads, making it the correct choice for this scenario.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 9

You are configuring Microsoft Entra ID for a new organization. The CIO wants to ensure that all external users who are invited to collaborate via Microsoft Entra B2B must go through an approval process before gaining access. Which setting should you configure?

Accepted Answer

Set 'External collaboration settings' to restrict invitations to specific admins. The 'External collaboration settings' in Microsoft Entra ID allow you to restrict who can invite external users. By setting the invitation restriction to 'Only users assigned to specific admin roles can invite', you ensure that all B2B collaboration invitations must be initiated by authorized admins, effectively requiring an approval process before external users gain access.

Answer

Create a Conditional Access policy requiring approval for external users

Answer

Enable guest self-service sign-up via user flows

Answer

Enable Identity Protection for guest users

Question 10

Which TWO of the following are valid authentication methods in Microsoft Entra ID that can be used as part of a Conditional Access policy? (Select two.)

Accepted Answer

Password. Password is a valid authentication method in Microsoft Entra ID that can be used as part of a Conditional Access policy. Conditional Access policies evaluate signals including user and group membership, location, device state, and the authentication method used. Password authentication is a primary method that can be controlled or restricted via Conditional Access, for example by requiring a stronger method when a password is used from an untrusted location.

Answer

SMS sign-in

Answer

Hardware OATH token

Answer

FIDO2 security key

Question 11

Which THREE of the following are required to configure Microsoft Entra ID Governance for automated user provisioning to a third-party SaaS application? (Select three.)

Accepted Answer

Assign the access package to a catalog. To configure automated user provisioning to a third-party SaaS application via Microsoft Entra ID Governance, the essential steps are creating an access package that includes the application (Option B) and assigning that access package to a catalog (Option A). The catalog serves as a container for grouping resources and access policies. Options C and D involve directory synchronization tools that are not required for provisioning to cloud SaaS apps; provisioning works from the cloud directory directly. Option E is for on-premises applications, not cloud SaaS apps. Therefore, only A and B are correct. Note that the question asks for three, but in practice only two are strictly required; the third common step (configuring automatic provisioning on the app side) is not listed among the options.

Answer

Set up Microsoft Entra Connect Sync for the application

Answer

Migrate from Azure AD Connect to Azure AD Connect cloud sync

Answer

Install and configure a provisioning agent in your on-premises environment

Question 12

Which TWO of the following are valid methods to enforce device compliance in a Conditional Access policy? (Select two.)

Accepted Answer

Require Microsoft Entra hybrid joined device. Requiring a Microsoft Entra hybrid joined device ensures the device is joined to both on-premises Active Directory and Microsoft Entra ID, which allows Conditional Access to enforce compliance based on the device's identity and configuration. Option E is correct because requiring the device to be marked as compliant relies on Microsoft Intune (or another MDM) to evaluate device health and policy adherence, and then Conditional Access blocks access if the device is not compliant.

Answer

Require Microsoft Authenticator

Answer

Require session persistence

Answer

Require approved client app

Question 13

You are reviewing a Conditional Access policy in JSON format. The policy is applied to all users accessing Office 365 from trusted locations. What is the intended behavior of this policy?

Accepted Answer

Users must provide MFA or use a compliant device. The policy grants access when users are in a trusted location and either provide MFA or use a compliant device. The 'OR' condition between MFA and device compliance means that satisfying either requirement is sufficient, not both. This is the standard behavior when multiple controls are assigned with 'Require one of the selected controls' in Conditional Access.

Answer

Users are blocked if they are not using a compliant device

Answer

Users must provide MFA and use a compliant device

Answer

Users only need to provide MFA regardless of device

Question 14

You are reviewing directory settings for Microsoft 365 Groups. Based on the exhibit, which statement is true?

Accepted Answer

All users in the tenant can create Microsoft 365 Groups. The exhibit shows that under 'Group creation settings,' the option 'Set which users can create Microsoft 365 Groups' is configured to 'Everyone.' This means all users in the tenant are permitted to create groups, regardless of membership in any security group. Therefore, option D is correct because the setting explicitly allows all users to create Microsoft 365 Groups.

Answer

Only users in a specific security group can create Microsoft 365 Groups

Answer

A naming policy is enforced for new groups

Answer

Groups must have a classification label

Question 15

An administrator runs the Azure CLI command shown in the exhibit. What is the result of this command?

Accepted Answer

A new application registration is created with requested permissions to Graph. The Azure CLI command `az ad app create --display-name 'MyApp' --required-resource-accesses '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4923c","type":"Scope"}]}]'` creates a new application registration in Microsoft Entra ID. The `--required-resource-accesses` parameter specifies the Microsoft Graph (resourceAppId `00000003-0000-0000-c000-000000000000`) and the permission with ID `e1fe6dd8-ba31-4d61-89e7-88639da4923c` (which corresponds to the `User.Read` delegated permission). This registers the app with requested permissions to Microsoft Graph, but does not grant admin consent or configure sign-in audience.

Answer

An existing application registration is updated

Answer

The application is configured with single-tenant sign-in audience

Answer

An admin consent is granted for the Microsoft Graph permissions

Question 16

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Accepted Answer

External identities. External identities in Microsoft Entra ID allow you to configure identity providers such as Google and Facebook, enabling users to sign in with their existing social media accounts. This is achieved by setting up federation with OAuth 2.0 and OpenID Connect protocols, which is the correct solution for the scenario described.

Answer

Microsoft Entra B2B collaboration

Answer

Managed identities

Answer

Microsoft Entra Identity Protection

Question 17

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. Users report that they are frequently prompted for multi-factor authentication (MFA) even after signing in successfully. You want to minimize these prompts while maintaining security. What should you configure?

Accepted Answer

Configure Authentication Session Management. Configuring Authentication Session Management in a Conditional Access policy allows you to control how often users are prompted for MFA by setting the sign-in frequency (e.g., every 24 hours) or persistent browser session (e.g., 'Remember MFA for 14 days'). This directly addresses the user complaint of frequent MFA prompts while maintaining security by enforcing reauthentication at defined intervals.

Answer

Modify the Conditional Access policy to require MFA for all apps

Answer

Change the per-user MFA state to Disabled

Answer

Adjust Identity Protection user risk policy

Question 18

You are a Microsoft 365 administrator. Your organization uses Microsoft Entra ID and Microsoft Intune for device management. You need to ensure that only compliant devices can access corporate email via Microsoft Outlook on mobile devices. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. Conditional Access policies in Microsoft Entra ID can enforce 'Require device to be marked as compliant' as a grant control. This ensures that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) are allowed to access corporate email via Outlook on mobile devices. The policy evaluates device compliance status reported by Intune and blocks access if the device is non-compliant.

Answer

Deploy app protection policies (MAM) for Outlook

Answer

Enable Microsoft Entra device registration

Answer

Create a device compliance policy in Intune

Question 19

Your organization is implementing a hybrid identity solution. You want to synchronize on-premises Active Directory users to Microsoft Entra ID. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID in a hybrid identity solution. It supports both password hash synchronization, pass-through authentication, and federation with Active Directory Federation Services (AD FS), making it the primary and most feature-rich sync tool for complex hybrid environments.

Answer

Microsoft Identity Manager

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Entra Connect Sync

Question 20

Your company has a Microsoft Entra tenant with 5,000 users. You need to delegate the ability to reset user passwords to the helpdesk team, but only for users in the Sales department. What is the most efficient way to achieve this?

Accepted Answer

Create an administrative unit for Sales, add Sales users, then assign a custom role scoped to that administrative unit. Administrative units allow scoping administrative roles to a subset of users, such as a department. By creating an administrative unit for Sales, adding Sales users, and assigning a custom role with password reset permissions to the helpdesk team scoped to that administrative unit, you can delegate password resets for only Sales users. Option B is wrong because a security group alone does not provide scope; the role assignment would still apply to all group members but without department scope. Option C is wrong because assigning a custom role without scope would allow password resets for all users, not just Sales. Option D is wrong because Global Administrator has far too many permissions.

Answer

Create a security group for Sales, then assign a custom role to the group

Answer

Create a custom role with password reset permissions and assign it to helpdesk

Answer

Add helpdesk users to the Global Administrator role