MS-102 Implement and manage Microsoft Entra identity and access — Timed 100 Questions

Question 1

A company uses Microsoft Entra ID for identity management. The security team wants to ensure that users cannot register applications in the tenant to prevent potential data leakage. Which setting should be configured?

Accepted Answer

Set 'Users can register applications' to 'No' in User settings. Option C is correct because setting 'Users can register applications' to 'No' in the Microsoft Entra ID User settings explicitly prevents non-admin users from creating application registrations in the tenant. This directly addresses the security team's goal of blocking users from registering apps, which could otherwise expose tenant data through misconfigured or malicious applications.

Answer

Set the 'Admin consent requests' setting to 'Allow'

Answer

Enable the 'Admin consent workflow'

Answer

Set 'Users can consent to apps accessing company data' to 'No'

Question 2

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use their existing on-premises passwords to log in to cloud services, while maintaining password policy enforcement on-premises. Which feature should you implement?

Accepted Answer

Password Hash Synchronization (PHS). Password Hash Synchronization (PHS) synchronizes the hash of on-premises Active Directory user passwords to Microsoft Entra ID, enabling users to log in to cloud services with the same password. It enforces password policies on-premises because the on-premises domain controller remains the authoritative source for password complexity, expiration, and lockout rules. PHS does not require additional infrastructure beyond Azure AD Connect and works even if the on-premises network is temporarily unavailable.

Answer

Pass-through Authentication with Seamless SSO

Answer

Active Directory Federation Services (AD FS)

Answer

Install Azure AD Connect with default settings

Question 3

A multinational company uses Microsoft Entra ID with Conditional Access policies. They have a policy that requires multi-factor authentication (MFA) for all users when accessing the company's custom SaaS application. However, users from the European branch are reporting that they are prompted for MFA every time, even though they have already authenticated via a compliant device. What is the most likely cause?

Accepted Answer

The Conditional Access policy has a session control that requires sign-in frequency. Option C is correct because the Conditional Access policy includes a session control that requires sign-in frequency, which forces users to re-authenticate with MFA at a specified interval regardless of device compliance or previous authentication. Even if the device is compliant and the user has already authenticated, the sign-in frequency control overrides session persistence and prompts for MFA again based on the configured time period (e.g., every hour). This explains why European branch users are repeatedly prompted for MFA despite having authenticated via a compliant device.

Answer

The user's device is not marked as compliant

Answer

The user has per-user MFA enabled

Answer

The policy includes a location condition that is not met

Question 4

You are configuring Microsoft Entra ID Protection. You want to automatically respond to a specific risk level by requiring the user to change their password. Which risk policy should you configure?

Accepted Answer

User risk policy. Option C is correct because the user risk policy can be configured to require a password change when user risk is elevated. Sign-in risk policy typically triggers MFA or block. Options A and D are not standard risk policies.

Answer

MFA registration policy

Answer

Sign-in risk policy

Answer

Session risk policy

Question 5

An organization is implementing Microsoft Entra Verified ID for verifiable credentials. They want to issue credentials to employees that can be used to prove employment status to third parties. Which component must be created first?

Accepted Answer

A credential manifest in the Microsoft Entra admin center. The credential manifest defines the rules for issuing a verifiable credential, including the claims schema, display information, and issuance policies. In Microsoft Entra Verified ID, you must create the credential manifest in the Entra admin center before any credentials can be issued, as it serves as the template that governs the credential's structure and validation. Without a manifest, there is no definition for what the credential contains or how it should be presented.

Answer

A presentation request policy

Answer

A distributed ledger network

Answer

A decentralized identifier (DID) for the organization

Question 6

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Accepted Answer

Deploy Azure AD Connect cloud sync. Option B is correct because Azure AD Connect can be configured for password writeback and also syncs account control flags. However, the specific feature to block sign-in quickly is not password writeback. Actually, the correct approach is to use Azure AD Connect's 'Exchange hybrid deployment' or 'UserPrincipalName update'? Wait, the correct answer is to use 'Azure AD Connect Sync' with 'userAccountControl' attribute sync. But among the options, Option B (Enable password writeback) does not block sign-in. Option A (Configure Azure AD Connect to sync the 'userAccountControl' attribute) is correct because the 'userAccountControl' attribute includes the 'ACCOUNTDISABLE' flag, and syncing it will disable the cloud account. However, the sync cycle runs every 30 minutes by default. To achieve 5 minutes, you need to use 'Azure AD Connect cloud sync' or 'Microsoft Identity Manager'. Since the question says 'configure', the closest is to enable the 'Password writeback'? No. Let me re-evaluate: The correct answer is to use 'Azure AD Connect' with 'Exchange hybrid' to sync 'msExchUserAccountControl'? Actually, the standard way is to sync 'userAccountControl' and set the sync interval to 5 minutes. But that's not an option. Option C (Deploy Azure AD Connect cloud sync) is the best because cloud sync can sync changes more frequently than 30 minutes. Option B (Enable password writeback) is for password changes, not account disable. Option D (Configure Microsoft Entra Connect Sync to use filtered synchronization) does not help. So Option C is correct.

Answer

Enable password writeback

Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute

Answer

Configure Microsoft Entra Connect Sync to use filtered synchronization

Question 7

A company uses Microsoft Entra ID and has enabled self-service password reset (SSPR). Users are required to register for SSPR. Management wants to ensure that users from the HR department, who handle sensitive data, must use two methods for authentication during SSPR, while other users can use one method. What is the best way to achieve this?

Accepted Answer

This is not possible because SSPR authentication method requirements are tenant-wide. SSPR authentication method requirements in Microsoft Entra ID are configured at the tenant level, not per user or group. This means you cannot specify that one group of users must use two methods while others use one; the number of methods required applies uniformly to all users enabled for SSPR. Therefore, option D is correct because the requirement cannot be differentiated by department or group.

Answer

Create a separate SSPR policy for the HR department using PowerShell

Answer

Use Microsoft Entra ID Governance to create an access package that requires two methods

Answer

Assign the HR users to a group and configure the SSPR policy for that group in the Entra admin center

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You want to set up a policy that automatically suspends a user if they download more than 100 files from SharePoint Online within 10 minutes. Which type of policy should you create?

Accepted Answer

Activity policy. An Activity policy in Microsoft Defender for Cloud Apps monitors user activities across connected apps and can trigger automated actions, such as suspending a user, when a specific threshold of downloads from SharePoint Online is exceeded within a defined time window. This policy type is designed to detect anomalous behavior patterns like mass file downloads, making it the correct choice for this scenario.

Answer

Session policy

Answer

File policy

Answer

App discovery policy

Question 9

You are configuring Microsoft Entra ID for a new organization. The CIO wants to ensure that all external users who are invited to collaborate via Microsoft Entra B2B must go through an approval process before gaining access. Which setting should you configure?

Accepted Answer

Set 'External collaboration settings' to restrict invitations to specific admins. Option B is correct because the 'External collaboration settings' in Microsoft Entra ID allow you to restrict who can invite external users. By setting the invitation restriction to 'Only users assigned to specific admin roles can invite', you ensure that all B2B collaboration invitations must be initiated by authorized admins, effectively requiring an approval process before external users gain access.

Answer

Create a Conditional Access policy requiring approval for external users

Answer

Enable guest self-service sign-up via user flows

Answer

Enable Identity Protection for guest users

Question 10

Which TWO of the following are valid authentication methods in Microsoft Entra ID that can be used as part of a Conditional Access policy? (Select two.)

Accepted Answer

Password. The correct answers are A and C. Password can be used as authentication method in Conditional Access policies (e.g., require MFA). Certificate-based authentication is also a valid method. SMS sign-in is not a method; it's for MFA. FIDO2 security key is a method, but the question says 'used as part of a Conditional Access policy' – actually, Conditional Access can grant access based on authentication strength that includes FIDO2. But the official list of authentication methods in Conditional Access includes password, certificate, and others. Option E (Hardware OATH token) is also valid. The question says 'Select two', so the most common are A and C. However, I need to be precise: In Conditional Access, you can require 'Password' as an authentication method? Actually, you can require 'Multi-factor authentication' or 'Passwordless authentication'. But the grant controls include 'Require multi-factor authentication', not individual methods. However, the authentication strength policy can include password. Given the exam, typical correct answers are password and certificate. Let me go with A and C.

Answer

SMS sign-in

Answer

Hardware OATH token

Answer

FIDO2 security key

Question 11

Which THREE of the following are required to configure Microsoft Entra ID Governance for automated user provisioning to a third-party SaaS application? (Select three.)

Accepted Answer

Assign the access package to a catalog. Option A is correct because access packages must be assigned to a catalog in Microsoft Entra ID Governance to define which resources (like the third-party SaaS application) are available for automated provisioning. The catalog acts as a container that groups related resources and access policies, enabling entitlement management to govern provisioning requests.

Answer

Set up Microsoft Entra Connect Sync for the application

Answer

Migrate from Azure AD Connect to Azure AD Connect cloud sync

Question 12

Which TWO of the following are valid methods to enforce device compliance in a Conditional Access policy? (Select two.)

Accepted Answer

Require Microsoft Entra hybrid joined device. Option D is correct because requiring a Microsoft Entra hybrid joined device ensures the device is joined to both on-premises Active Directory and Microsoft Entra ID, which allows Conditional Access to enforce compliance based on the device's identity and configuration. Option E is correct because requiring the device to be marked as compliant relies on Microsoft Intune (or another MDM) to evaluate device health and policy adherence, and then Conditional Access blocks access if the device is not compliant.

Answer

Require Microsoft Authenticator

Answer

Require session persistence

Answer

Require approved client app

Question 13

You are reviewing a Conditional Access policy in JSON format. The policy is applied to all users accessing Office 365 from trusted locations. What is the intended behavior of this policy?

Accepted Answer

Users must provide MFA or use a compliant device. The policy grants access when users are in a trusted location and either provide MFA or use a compliant device. The 'OR' condition between MFA and device compliance means that satisfying either requirement is sufficient, not both. This is the standard behavior when multiple controls are assigned with 'Require one of the selected controls' in Conditional Access.

Answer

Users are blocked if they are not using a compliant device

Answer

Users must provide MFA and use a compliant device

Answer

Users only need to provide MFA regardless of device

Question 14

You are reviewing directory settings for Microsoft 365 Groups. Based on the exhibit, which statement is true?

Accepted Answer

All users in the tenant can create Microsoft 365 Groups. The exhibit shows that under 'Group creation settings,' the option 'Set which users can create Microsoft 365 Groups' is configured to 'Everyone.' This means all users in the tenant are permitted to create groups, regardless of membership in any security group. Therefore, option D is correct because the setting explicitly allows all users to create Microsoft 365 Groups.

Answer

Only users in a specific security group can create Microsoft 365 Groups

Answer

A naming policy is enforced for new groups

Answer

Groups must have a classification label

Question 15

An administrator runs the Azure CLI command shown in the exhibit. What is the result of this command?

Accepted Answer

A new application registration is created with requested permissions to Graph. The Azure CLI command `az ad app create --display-name 'MyApp' --required-resource-accesses '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4923c","type":"Scope"}]}]'` creates a new application registration in Microsoft Entra ID. The `--required-resource-accesses` parameter specifies the Microsoft Graph (resourceAppId `00000003-0000-0000-c000-000000000000`) and the permission with ID `e1fe6dd8-ba31-4d61-89e7-88639da4923c` (which corresponds to the `User.Read` delegated permission). This registers the app with requested permissions to Microsoft Graph, but does not grant admin consent or configure sign-in audience.

Answer

An existing application registration is updated

Answer

The application is configured with single-tenant sign-in audience

Answer

An admin consent is granted for the Microsoft Graph permissions

Question 16

Your organization uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook. Which identity solution should you configure?

Accepted Answer

External identities. External identities in Microsoft Entra ID allow you to configure identity providers such as Google and Facebook, enabling users to sign in with their existing social media accounts. This is achieved by setting up federation with OAuth 2.0 and OpenID Connect protocols, which is the correct solution for the scenario described.

Answer

Microsoft Entra B2B collaboration

Answer

Managed identities

Answer

Microsoft Entra Identity Protection

Question 17

Your company has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. Users report that they are frequently prompted for multi-factor authentication (MFA) even after signing in successfully. You want to minimize these prompts while maintaining security. What should you configure?

Accepted Answer

Configure Authentication Session Management. Option A is correct because configuring Authentication Session Management in a Conditional Access policy allows you to control how often users are prompted for MFA by setting the sign-in frequency (e.g., every 24 hours) or persistent browser session (e.g., 'Remember MFA for 14 days'). This directly addresses the user complaint of frequent MFA prompts while maintaining security by enforcing reauthentication at defined intervals.

Answer

Modify the Conditional Access policy to require MFA for all apps

Answer

Change the per-user MFA state to Disabled

Answer

Adjust Identity Protection user risk policy

Question 18

You are a Microsoft 365 administrator. Your organization uses Microsoft Entra ID and Microsoft Intune for device management. You need to ensure that only compliant devices can access corporate email via Microsoft Outlook on mobile devices. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Require device to be marked as compliant'. Option A is correct because Conditional Access policies in Microsoft Entra ID can enforce 'Require device to be marked as compliant' as a grant control. This ensures that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) are allowed to access corporate email via Outlook on mobile devices. The policy evaluates device compliance status reported by Intune and blocks access if the device is non-compliant.

Answer

Deploy app protection policies (MAM) for Outlook

Answer

Enable Microsoft Entra device registration

Answer

Create a device compliance policy in Intune

Question 19

Your organization is implementing a hybrid identity solution. You want to synchronize on-premises Active Directory users to Microsoft Entra ID. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (formerly Azure AD Connect) is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID in a hybrid identity solution. It supports both password hash synchronization, pass-through authentication, and federation with Active Directory Federation Services (AD FS), making it the primary and most feature-rich sync tool for complex hybrid environments.

Answer

Microsoft Identity Manager

Answer

Microsoft Entra Cloud Sync

Answer

Microsoft Entra Connect Sync

Question 20

Your company has a Microsoft Entra tenant with 5,000 users. You need to delegate the ability to reset user passwords to the helpdesk team, but only for users in the Sales department. What is the most efficient way to achieve this?

Accepted Answer

Create an administrative unit for Sales, add Sales users, then assign a custom role scoped to that administrative unit. Option C is correct because administrative units allow scoping administrative roles to a subset of users, such as a department. Option A is wrong because assigning the global admin role grants too much permission. Option B is wrong because assigning a custom role without scope would apply to all users. Option D is wrong because creating a new group and assigning role to the group still applies to all users in the group, not scoped by department.

Answer

Create a security group for Sales, then assign a custom role to the group

Answer

Create a custom role with password reset permissions and assign it to helpdesk

Answer

Add helpdesk users to the Global Administrator role