MS-102 Implement and manage Microsoft Entra identity and access — 40 Questions

Question 1

Which TWO of the following are valid authentication methods in Microsoft Entra ID that can be used as part of a Conditional Access policy? (Select two.)

Accepted Answer

Password. Password (B) is a valid authentication method in Microsoft Entra ID and can be referenced in Conditional Access policies, for example to require MFA or block legacy authentication when a password-based sign-in occurs. Certificate-based authentication (C) is also a supported Microsoft Entra authentication method and can be targeted by Conditional Access, such as requiring certificate-based authentication or combining it with other controls. SMS sign-in (A) is not a valid Entra ID authentication method for Conditional Access; SMS is only used as a secondary factor for MFA, not as a primary authentication method. Hardware OATH token (D) and FIDO2 security key (E) are authentication methods in Entra ID, but they are not among the two options marked correct here, so they do not satisfy the question as posed.

Answer

SMS sign-in

Answer

Hardware OATH token

Answer

FIDO2 security key

Question 2

Which THREE of the following are required to configure Microsoft Entra ID Governance for automated user provisioning to a third-party SaaS application? (Select three.)

Accepted Answer

Assign the access package to a catalog. Option B is correct because entitlement management access packages are the container that defines the resources (including the SaaS application) and policies used to govern and automate user provisioning. Option A is correct because an access package must be assigned to a catalog so it can be discovered, managed, and made available to users for automated assignment and provisioning. Option C is incorrect because Microsoft Entra Connect Sync is used to synchronize on-premises Active Directory identities to Entra ID, not to provision users to a third-party SaaS application. Option D is incorrect because migrating to cloud sync is an identity synchronization task and is not required for SaaS application provisioning. Option E is incorrect because a provisioning agent is only needed for on-premises applications (such as ECMA/SQL-based apps), not for cloud-based third-party SaaS applications.

Answer

Set up Microsoft Entra Connect Sync for the application

Answer

Migrate from Azure AD Connect to Azure AD Connect cloud sync

Answer

Install and configure a provisioning agent in your on-premises environment

Question 3

You are reviewing the following Conditional Access policy JSON in Microsoft Entra ID. What does this policy do?

Accepted Answer

Requires MFA for all users except Admin@contoso.com when accessing any app from mobile apps or desktop clients. The Conditional Access policy JSON targets all users except a specific group containing Admin@contoso.com, applies to all cloud apps, and requires MFA for the 'Browser' and 'Mobile apps and desktop clients' client app types. This effectively enforces MFA for all users except the excluded admin when accessing any app from either web browsers or native/mobile clients, as defined by the 'clientAppTypes' condition.

Answer

Requires MFA for all users accessing all apps from any client type

Answer

Blocks access for all users except Admin@contoso.com when accessing from mobile apps

Answer

Requires MFA for all users accessing all apps from any device

Question 4

Your company has a Microsoft 365 tenant with Microsoft Entra ID. You are configuring Conditional Access policies to enforce multifactor authentication (MFA) for all users. However, you want to exclude break-glass emergency access accounts from MFA. What is the recommended best practice for managing these emergency access accounts?

Accepted Answer

Configure the emergency access accounts with a long, complex password and exclude them from MFA policies. Microsoft's documented best practice for break-glass accounts is to make them cloud-only (not synced from on-premises AD), assign them a long complex password, and exclude them from all Conditional Access policies including MFA. Cloud-only accounts avoid dependency on on-premises infrastructure that could be unavailable during an outage, and excluding them from MFA ensures they remain usable when the MFA service itself is the thing that is broken. This is the only configuration that guarantees emergency access during a tenant-wide authentication incident.

Answer

Disable sign-in for the emergency access accounts until needed

Answer

Make the emergency access accounts cloud-only and enforce MFA

Answer

Assign FIDO2 security keys to the emergency access accounts

Question 5

Your organization uses Microsoft Entra ID Governance. You need to ensure that access reviews are automatically created for all guest users in the tenant and that reviews are sent to the guest users' managers for approval. You configure an access review policy. Which identity governance feature should you use?

Accepted Answer

Entitlement Management. B is correct because Entitlement Management in Microsoft Entra ID Governance allows you to configure access review policies that automatically create reviews for guest users and assign them to the guest users' managers for approval. This feature integrates with access reviews to enforce governance over external identities, ensuring that guest access is periodically recertified by the appropriate authority.

Answer

Terms of Use

Answer

Access Reviews

Answer

Privileged Identity Management

Question 6

Your organization uses Microsoft Entra ID and wants to implement Identity Protection to detect risky users. Which THREE risk types can be detected by Identity Protection? (Choose three.)

Accepted Answer

Impossible travel. Identity Protection detects several risk types, and the three correct answers here are A, C, and D. Impossible travel (A) is a user risk detection that flags sign-ins from geographically distant locations within a timeframe that makes physical travel impossible, indicating a compromised account. Leaked credentials (C) is a user risk detection triggered when a user's valid credentials are found in a public dump or dark web source, indicating the account is at high risk. Anonymous IP address (D) is a sign-in risk detection that identifies sign-ins originating from anonymizing sources such as Tor browsers or anonymized VPNs, which can indicate malicious intent. Password spray (B) is not a standalone Identity Protection risk type; it is a detection surfaced through other Microsoft Entra security features, not one of the Identity Protection risk detections. Malware (E) is not an Identity Protection risk type either; it is associated with other Microsoft security services such as Microsoft Defender for Endpoint, not Entra ID Identity Protection.

Answer

Password spray

Answer

Malware

Question 7

Your organization uses Microsoft Entra ID and wants to allow users to reset their own passwords using self-service password reset (SSPR). What is the minimum licensing required?

Accepted Answer

Microsoft Entra ID Free. Microsoft Entra ID Free includes self-service password reset (SSPR) for cloud-only users, making it the actual minimum licensing required. While Microsoft 365 Business Basic also includes Entra ID Free, it is not the minimum because the free tier alone is sufficient without any paid subscription.

Answer

Microsoft Entra ID P2

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID P1

Question 8

Your company uses Microsoft Entra ID and has an application that requires users to consent to permissions. You want to allow users to consent to low-risk permissions but require admin approval for high-risk permissions. What should you configure?

Accepted Answer

Configure the 'Admin consent settings' to allow user consent for low-risk permissions and require admin consent for high-risk permissions.. Microsoft Entra ID's admin consent settings allow you to configure a policy that permits user consent for low-risk permissions (e.g., those with no admin-restricted scopes) while requiring admin approval for high-risk permissions (e.g., those requiring admin consent). This granular control is achieved through the 'Admin consent settings' blade, where you can enable 'Allow user consent for apps' and then define a permission classification policy to categorize permissions as low or high risk.

Answer

Set user consent to 'Do not allow user consent'.

Answer

Set user consent to 'Allow user consent for apps'.

Answer

Create a Conditional Access policy that blocks high-risk consent.

Question 9

Your organization uses Microsoft Entra ID. You need to ensure that users cannot reuse their last 5 passwords when changing passwords. What should you configure?

Accepted Answer

Password protection policy - enforce password history.. The password history policy in Microsoft Entra ID (formerly Azure AD) enforces the number of unique passwords a user must use before they can reuse an old password. By setting the password history value to 5, users cannot reuse any of their last 5 passwords when changing their password. This directly meets the requirement to prevent reuse of the last 5 passwords.

Answer

Multi-factor authentication settings.

Answer

Account lockout threshold.

Answer

Smart lockout settings.

Question 10

Your organization uses Microsoft Entra ID and has a custom role that includes the permission 'microsoft.directory/applications/credentials/update'. You need to create a new role that includes all permissions of the existing role except the credential update permission. What is the best approach?

Accepted Answer

Use the 'Copy role' option from the existing role and then remove the credential update permission.. The best approach is to copy the existing role and remove the unwanted permission. This allows you to start with all the existing permissions and then remove the credential update permission, ensuring you don't miss any permissions. Option B is incorrect because a Conditional Access policy cannot block specific permissions within a role; this is not feasible. Option C is incorrect because the Application Administrator role is a built-in role that includes many permissions beyond the original role and may include the credential update permission as well. Option D is incorrect because it would require manually adding all permissions, which is error-prone and less efficient than copying the role.

Answer

Assign the existing role to the user and create a Conditional Access policy that blocks credential update.

Answer

Assign the built-in Application Administrator role instead.

Answer

Create a new custom role and manually add all permissions except credential update.

Question 11

Which TWO of the following are required to configure Microsoft Entra ID self-service password reset (SSPR) for cloud-only users? (Choose two.)

Accepted Answer

Users must be assigned a license.. Option C is correct because SSPR requires each user who will use the feature to be assigned a license that includes Microsoft Entra ID (Azure AD) — without an assigned license, the user cannot use SSPR. Option D is correct because a paid Microsoft 365 license (which includes Entra ID) satisfies that licensing requirement for cloud-only users, enabling SSPR. Microsoft Entra Connect synchronization (B) is not required for cloud-only users, since they exist only in Entra ID and are not synced from on-premises AD. Microsoft Entra ID P1 or P2 (A) is not strictly required for basic SSPR for cloud-only users, as SSPR is included with free/Microsoft 365 licensing for cloud users (P1/P2 is needed for on-premises writeback scenarios). MFA registration (E) is a prerequisite for SSPR in some configurations, but it is not the licensing requirement being asked about here.

Answer

Microsoft Entra ID P1 or P2 license.

Answer

Azure AD Connect synchronization.

Answer

Users must register for MFA.

Question 12

Which TWO of the following are features of Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk policy that can block risky sign-ins.. Option A is correct because Microsoft Entra ID Identity Protection provides a sign-in risk policy that evaluates the probability that a given authentication attempt is not authorized and can automatically block risky sign-ins or require MFA. Option D is correct because Identity Protection also offers a user risk policy that detects when a user account may be compromised and can block sign-ins or force a secure password change. Options B and C describe related capabilities but are not the specific policy features asked for: risk detections are the underlying signals, and Conditional Access integration is a broader mechanism, not a standalone Identity Protection feature. Option E is incorrect because Advanced Threat Protection (ATP) is a separate Microsoft Defender branding, not an Identity Protection feature.

Answer

Risk detections such as leaked credentials and anonymous IP address.

Answer

Conditional Access policies integration.

Answer

Advanced Threat Protection (ATP) for identities.

Question 13

Refer to the exhibit. You run the PowerShell command to check the authentication method policy registration campaign. Which of the following is true?

Accepted Answer

All users will be prompted to register authentication methods via email.. The exhibit shows the output of the `Get-MgPolicyAuthenticationMethodPolicyRegistrationEnforcement` cmdlet, which reveals that the `state` is `enabled` and the `targetType` is `allUsers`. This means the registration campaign is active and targets every user in the tenant. The `includeTargets` block confirms all users are included, and the `excludeTargets` array is empty, so no users are excluded. Therefore, all users will be prompted via email to register authentication methods, making option B correct.

Answer

Only administrators are targeted for registration.

Answer

Users in the ExcludeTargets group will be excluded.

Answer

The registration campaign is disabled.

Question 14

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can access internal applications using single sign-on (SSO) without storing passwords in the cloud. Which authentication method should you implement?

Accepted Answer

Windows Hello for Business. Windows Hello for Business is correct because it enables passwordless single sign-on (SSO) to internal applications using biometric or PIN credentials, with the private key stored on the user's device rather than in the cloud. This meets the requirement of no passwords stored in the cloud while still providing seamless SSO access.

Answer

Federation with AD FS

Answer

Password hash synchronization

Answer

Pass-through authentication

Question 15

Your organization uses Microsoft Entra ID and plans to deploy Microsoft Copilot for Microsoft 365. You need to ensure that Copilot respects the conditional access policies you have configured for data access. What should you do?

Accepted Answer

Apply sensitivity labels to data and configure conditional access policies to require labels. Microsoft Copilot for Microsoft 365 respects conditional access policies only when those policies are configured to require sensitivity labels. Copilot uses Microsoft Purview Information Protection to enforce data access controls based on labels, ensuring that policies like location, device compliance, or sign-in risk are applied to Copilot interactions. Without label-based policies, Copilot may bypass standard conditional access conditions.

Answer

Use Microsoft Defender for Cloud Apps session controls

Answer

Configure Privileged Identity Management (PIM) for Copilot roles

Answer

Enable Identity Protection for Copilot users

Question 16

Your organization uses Microsoft Entra ID. You need to implement a solution that allows users to sign in without a password using their smartphone. Which TWO authentication methods can be used?

Accepted Answer

Microsoft Authenticator app (phone sign-in). Option D (Microsoft Authenticator app phone sign-in) is correct because passwordless phone sign-in lets users authenticate by approving a prompt in the Microsoft Authenticator app on their smartphone, using a registered credential tied to the device rather than a password. Option E (FIDO2 security keys) is correct because FIDO2 security keys are a supported passwordless authentication method in Microsoft Entra ID, using WebAuthn and public-key cryptography for phishing-resistant sign-in. Option A (Temporary Access Pass) is not correct because it is a time-limited passcode used for onboarding or recovery, not a smartphone-based passwordless sign-in method. Option B (Windows Hello for Business) is not correct because it is a passwordless method tied to a Windows device using PIN, biometrics, or a security key, not a smartphone. Option C (Text message SMS verification code) is not correct because SMS codes are a form of multi-factor authentication, not a passwordless authentication method.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

Text message (SMS) verification code

Question 17

Refer to the exhibit. You have created a conditional access policy as shown. Users report that they can still access cloud apps from non-compliant devices. What is the most likely reason?

Accepted Answer

The policy uses session controls instead of grant controls. The policy uses session controls (e.g., 'Use app enforced restrictions') instead of grant controls (e.g., 'Require device to be marked as compliant'). Session controls only apply additional restrictions within the session but do not block access. Therefore, even non-compliant devices can still access cloud apps, though they may experience limited functionality. Grant controls are required to enforce device compliance and block access if the condition is not met.

Answer

The policy does not exclude specific users

Answer

The policy does not include all cloud apps

Answer

The grant control operator is set to "OR" with only one control, which requires no controls to be satisfied

Question 18

Refer to the exhibit. You run the KQL query in Microsoft Sentinel. The query returns zero results even though you know user@contoso.com has had failed sign-in attempts in the last 30 days. What is the most likely reason?

Accepted Answer

The query filters on UserPrincipalName incorrectly. The query filters on UserPrincipalName, but the actual field in the sign-in logs might be named differently (e.g., UserId) or the format may not match (e.g., email vs UPN). This causes the query to return zero results. Option A is incorrect because data retention in Sentinel can be configured for more than 7 days. Option B is incorrect because the summarize statement is syntactically correct. Option D is incorrect because the query does not filter out successful sign-ins; it likely targets failed sign-ins based on the context.

Answer

The query uses ago(30d) but the data retention is only 7 days

Answer

The summarize statement is incorrect

Answer

The query excludes successful sign-ins

Question 19

A company uses Microsoft Entra ID with group-based licensing. You assign a license to a group, but some members do not receive the license. There are no error messages in the audit logs. What is the most likely cause?

Accepted Answer

Users have the license directly assigned. When a user has a license directly assigned, group-based licensing skips that user because the direct assignment takes precedence. The group licensing engine detects the existing license and does not attempt to reassign it, so no error is logged. This is the most common cause of silent license assignment failures in Microsoft Entra ID.

Answer

The group has more than 500 members

Answer

The group is a dynamic group

Answer

The product license is out of stock

Question 20

You need to enforce multifactor authentication (MFA) for all users in a Microsoft Entra ID tenant. The solution must not require users to register security info if they already have it. Which approach should you use?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users. A Conditional Access policy can require MFA for all users while respecting existing security info registration. The policy triggers MFA during sign-in but does not force re-registration if the user has already registered. This meets the requirement of not requiring users to register security info if they already have it.

Answer

Use identity protection to enforce MFA for risky sign-ins

Answer

Assign MFA per user in the Microsoft Entra admin center

Answer

Enable security defaults