MS-102 Hard Questions — 25 Difficult Questions

Question 1

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Microsoft Entra Connect Sync to synchronize user accounts. The security team requires that all cloud-only users must be blocked from syncing to on-premises AD. What should you do to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure attribute mapping to filter out cloud-only users from writeback. Configuring attribute mapping to filter out cloud-only users from writeback directly prevents those users from being written back to on-premises Active Directory. In Microsoft Entra Connect Sync, attribute mapping rules can include scoping filters that exclude objects based on specific attributes, such as a custom attribute or the cloud-only user indicator. This ensures that only synchronized users are written back, meeting the security requirement without affecting other sync operations.

Answer

Use the cloudFilter attribute to mark cloud-only users as false

Answer

Disable directory writeback in Microsoft Entra Connect Sync

Answer

Configure Selective Password Hash Sync to exclude cloud-only users

Question 2

Your organization has a Microsoft 365 tenant with 10,000 users. You are configuring Microsoft Entra ID Identity Protection to detect risky sign-ins. You need to ensure that when a sign-in risk level of 'High' is detected, the user is blocked from signing in and an administrator is notified. What should you configure?

Accepted Answer

Create a Conditional Access policy with 'Sign-in risk' condition set to 'High' and 'Block access', and configure alert notifications in Identity Protection. It combines a Conditional Access policy that blocks access when the sign-in risk level is 'High' with an alert notification configured in Identity Protection. The Conditional Access policy enforces the block at the authentication level, while the Identity Protection alert ensures administrators are notified of the high-risk sign-in event. This directly meets the requirement to both block the user and notify an admin.

Answer

Create a user risk policy in Identity Protection to block high-risk users

Answer

Create an MFA registration policy in Identity Protection

Answer

Enable Security defaults and configure notifications

Question 3

Your company uses Microsoft Entra ID and has a hybrid identity with PHS. You need to ensure that when an on-premises user account is disabled, the corresponding cloud user is also blocked from signing in within 5 minutes. What should you configure?

Accepted Answer

Deploy Azure AD Connect cloud sync. Azure AD Connect cloud sync can be configured to synchronize the on-premises Active Directory 'userAccountControl' attribute, which includes the 'ACCOUNTDISABLE' flag. When an on-premises user account is disabled, this flag changes, and cloud sync can trigger a block on the corresponding cloud user's sign-in within a few minutes (typically under 5 minutes) due to its near-real-time sync cycle. This meets the requirement without relying on the slower default sync interval of Azure AD Connect.

Answer

Enable password writeback

Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute

Answer

Configure Microsoft Entra Connect Sync to use filtered synchronization

Question 4

Refer to the exhibit. You run the PowerShell command to check the authentication method policy registration campaign. Which of the following is true?

Accepted Answer

All users will be prompted to register authentication methods via email.. The exhibit shows the output of the `Get-MgPolicyAuthenticationMethodPolicyRegistrationEnforcement` cmdlet, which reveals that the `state` is `enabled` and the `targetType` is `allUsers`. This means the registration campaign is active and targets every user in the tenant. The `includeTargets` block confirms all users are included, and the `excludeTargets` array is empty, so no users are excluded. Therefore, all users will be prompted via email to register authentication methods, making option B correct.

Answer

Only administrators are targeted for registration.

Answer

Users in the ExcludeTargets group will be excluded.

Answer

The registration campaign is disabled.

Question 5

Your company recently acquired a subsidiary that uses a different Microsoft 365 tenant. You are tasked with merging the two tenants into one. The subsidiary has 1,500 users with unique email domains. You need to migrate all users, mailboxes, and SharePoint data while minimizing downtime and preserving data integrity. You have access to both tenants as global admin. What should you do first?

Accepted Answer

Use a third-party migration tool such as BitTitan MigrationWiz to perform the migration. Microsoft does not provide a native tool for merging two tenants; third-party tools like BitTitan MigrationWiz are designed specifically for cross-tenant migrations, supporting mailbox, SharePoint, and user data migration with minimal downtime and data integrity. These tools handle directory synchronization, mailbox rehydration, and SharePoint content mapping, which are critical for a 1,500-user migration with unique domains.

Answer

Add the subsidiary's domain to the primary tenant, then delete the subsidiary tenant and recreate users

Answer

Use the Microsoft 365 Merger Center in the admin portal

Answer

Use Microsoft's native tenant-to-tenant migration by moving mailboxes via PowerShell and exporting SharePoint content

Question 6

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 7

Refer to the exhibit. The Contoso tenant has a cross-tenant access policy configured for Fabrikam. Users from Fabrikam are unable to access resources in Contoso via B2B collaboration. What is the most likely reason?

Accepted Answer

The B2BCollaborationInbound setting for Fabrikam does not allow any identities or applications. The B2BCollaborationInbound setting for Fabrikam controls which external users and applications are allowed to access Contoso resources via B2B collaboration. If this setting does not allow any identities or applications, all inbound B2B collaboration attempts from Fabrikam will be blocked, even if the default cross-tenant access policy is permissive.

Answer

The B2BCollaborationOutbound setting is blocking access

Answer

The default cross-tenant access policy is set to block all

Answer

The B2BDirectConnectInbound setting is empty

Question 8

A company wants to require approval for any activation of the Global Administrator role in Privileged Identity Management (PIM). The approvers are predefined as members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to meet these requirements?

Accepted Answer

Edit the role settings of the Global Administrator role in PIM.. The requirement to require approval, enforce a business justification, and set a 4-hour expiration for Global Administrator activations is configured in the role settings of the Global Administrator role within Privileged Identity Management (PIM). These settings control activation parameters such as approval requirements, justification, and maximum activation duration, which directly map to the stated needs.

Answer

Create an access review for the Global Administrator role.

Answer

Configure Azure AD Identity Protection to require MFA for Global Administrator.

Answer

Assign the Global Administrator role directly to the users temporarily.

Question 9

Your organization has Microsoft Defender for Cloud Apps (MCAS) deployed. You need to create a policy that automatically blocks downloads of files classified as 'Highly Confidential' from SharePoint Online to unmanaged devices. Which policy type should you use?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps (MCAS) is the correct choice because it enables real-time monitoring and control of user activities in cloud apps, such as blocking downloads based on file sensitivity labels. This policy type uses reverse proxy architecture to inspect and intervene in user sessions, allowing you to block downloads of 'Highly Confidential' files from SharePoint Online to unmanaged devices.

Answer

Access policy

Answer

Activity policy

Answer

App discovery policy

Question 10

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to ensure that when a user's on-premises Active Directory account is disabled, their Microsoft Entra ID account is also disabled within 30 minutes. What should you do?

Accepted Answer

Configure Azure AD Connect to sync the 'userAccountControl' attribute and set the sync frequency to 30 minutes.. Disabling an on-premises Active Directory account sets the 'userAccountControl' attribute (specifically the ACCOUNTDISABLE flag, bit 2). By configuring Azure AD Connect to sync this attribute and setting the sync frequency to 30 minutes, the disabled state is replicated to Microsoft Entra ID within that interval, ensuring the cloud account is also disabled.

Answer

Enable Azure AD Connect cloud sync.

Answer

Configure password hash synchronization to run every 30 minutes.

Answer

Enable password writeback.

Question 11

A company has a Microsoft 365 E5 tenant with 10,000 users. You need to delegate the ability to manage Microsoft Entra ID roles to a group of support engineers. The solution must follow the principle of least privilege and allow engineers to assign only specific roles to users. What should you do?

Accepted Answer

Create a custom role in Microsoft Entra ID with permissions to assign specific roles, and use PIM to enable just-in-time access. It follows the principle of least privilege by creating a custom role that grants only the specific permissions needed to assign designated roles, and using Privileged Identity Management (PIM) for just-in-time (JIT) access ensures engineers are elevated only when required. This approach avoids granting standing administrative privileges and allows granular control over which roles can be assigned, meeting the requirement to delegate role management without over-provisioning.

Answer

Assign the engineers the Privileged Role Administrator role

Answer

Add the engineers to the Global Administrator role in Microsoft Entra ID

Answer

Create a group in Microsoft Entra ID and assign it the User Administrator role, then use PIM to elevate

Question 12

A company uses Microsoft Entra ID with group-based licensing. You assign a license to a group, but some members do not receive the license. There are no error messages in the audit logs. What is the most likely cause?

Accepted Answer

Users have the license directly assigned. When a user has a license directly assigned, group-based licensing skips that user because the direct assignment takes precedence. The group licensing engine detects the existing license and does not attempt to reassign it, so no error is logged. This is the most common cause of silent license assignment failures in Microsoft Entra ID.

Answer

The group has more than 500 members

Answer

The group is a dynamic group

Answer

The product license is out of stock

Question 13

You are a Microsoft 365 administrator. Your tenant has a Microsoft Entra ID P2 license. You need to create a dynamic group for all users whose department is 'Engineering' and who are located in the United States. Which rule syntax should you use?

Accepted Answer

user.department -eq "Engineering" and user.country -eq "United States". Dynamic group rules in Microsoft Entra ID require the use of lowercase 'and' as the logical operator, and the country attribute value must match the display name 'United States' as stored in the directory. The rule syntax must follow the property -operator 'value' format exactly, with no capitalization of 'and'.

Answer

user.department -eq "Engineering" and user.country -eq "US"

Answer

user.department -eq "Engineering" And user.country -eq "United States"

Answer

user.department -eq "Engineering" AND user.country -eq "United States"

Question 14

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove messages identified as malware from all mailboxes after delivery. What should you configure?

Accepted Answer

Enable Zero-hour auto purge (ZAP) in the anti-malware policy.. Zero-hour auto purge (ZAP) is the correct feature because it automatically detects and removes messages that are identified as malware after they have already been delivered to a user's mailbox. By enabling ZAP in the anti-malware policy, the system retroactively moves malicious messages to the user's Junk Email folder or quarantines them, ensuring post-delivery protection without manual intervention.

Answer

Configure an anti-malware policy with a high-confidence verdict.

Answer

Set up a mailbox intelligence policy.

Answer

Create an anti-phishing policy to block spoofed senders.

Question 15

Your organization uses Microsoft Entra ID and has a custom role that grants 'microsoft.directory/applications/credentials/update' permission. A security audit reveals that a user assigned this role has modified credentials for an application. You need to prevent such actions while allowing other application updates. What should you do?

Accepted Answer

Create a custom role that excludes the 'microsoft.directory/applications/credentials/update' permission and assign it to the user.. The custom role currently includes the 'microsoft.directory/applications/credentials/update' permission, which allows modifying application credentials. To prevent credential updates while still permitting other application updates, you must create a new custom role that explicitly excludes this permission and assign it to the user. This approach preserves granular control without granting unnecessary privileges, unlike built-in roles that would either over-scope or under-scope permissions.

Answer

Assign the user the built-in Application Administrator role instead.

Answer

Enable multi-factor authentication for the user.

Answer

Remove the user from the custom role and assign them another role with fewer permissions.

Question 16

You are the Microsoft 365 administrator for a large enterprise with 50,000 users. The company is deploying Microsoft 365 Copilot for all users. You need to ensure that the data used by Copilot is protected and that Copilot does not inadvertently expose sensitive information. The company has strict data residency requirements: all data must remain within the European Union (EU). You have already configured data boundaries in Microsoft 365 to keep data in the EU. However, you are concerned about Copilot's AI model training. You need to implement additional controls. The company uses Microsoft Purview Information Protection with sensitivity labels. You have created a sensitivity label "Highly Confidential" that applies encryption and a "Confidential" label that applies visual markings. You also have a DLP policy that prevents sharing of "Highly Confidential" data externally. You need to ensure that when a user uses Copilot with a document labeled "Highly Confidential", the Copilot response does not include any of the sensitive content from that document. What should you do?

Accepted Answer

Ensure that the Highly Confidential sensitivity label includes encryption when applied.. The 'Highly Confidential' sensitivity label already applies encryption, which prevents Microsoft 365 Copilot from accessing the document's content. Copilot cannot process or include encrypted content in its responses, as encryption blocks the AI model from reading the underlying data. This ensures that sensitive information from encrypted documents is not inadvertently exposed in Copilot outputs.

Answer

Exclude users who handle Highly Confidential data from Copilot licensing.

Answer

Create a DLP policy that blocks Copilot from accessing documents labeled Highly Confidential.

Answer

Configure Microsoft 365 data boundaries to restrict Copilot data processing to the EU.

Question 17

Your organization uses Microsoft Sentinel for security operations. You need to ensure that Sentinel can ingest logs from Microsoft 365 Defender (XDR) and Microsoft Entra ID. Which THREE data connectors should you enable? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint is a correct data connector because it ingests endpoint detection and response (EDR) logs from Windows, macOS, and Linux devices into Microsoft Sentinel. This integration allows security operations to correlate endpoint alerts with other signals, enabling advanced hunting and automated incident response across the Microsoft 365 Defender ecosystem.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Intune

Question 18

You are reviewing directory settings for Microsoft 365 Groups. Based on the exhibit, which statement is true?

Accepted Answer

All users in the tenant can create Microsoft 365 Groups. The exhibit shows that under 'Group creation settings,' the option 'Set which users can create Microsoft 365 Groups' is configured to 'Everyone.' This means all users in the tenant are permitted to create groups, regardless of membership in any security group. Therefore, option D is correct because the setting explicitly allows all users to create Microsoft 365 Groups.

Answer

Only users in a specific security group can create Microsoft 365 Groups

Answer

A naming policy is enforced for new groups

Answer

Groups must have a classification label

Question 19

You are the Microsoft 365 administrator for a company with a hybrid identity configuration using Azure AD Connect. The company has a custom domain 'contoso.com' federated with Active Directory Federation Services (ADFS). All users are synced from on-premises Active Directory. The security team wants to implement Microsoft Entra ID Protection to detect risky sign-ins. However, they are concerned that federated authentication bypasses some risk detection capabilities. You need to ensure that Microsoft Entra ID Protection can evaluate risk for all sign-ins, including federated ones. What should you do?

Accepted Answer

Switch from federated authentication to Pass-through Authentication (PTA) or Password Hash Sync (PHS).. Microsoft Entra ID Protection relies on signals such as IP addresses, device information, and sign-in patterns to calculate risk. In a federated setup with ADFS, the authentication happens on-premises, and Azure AD only receives a token—not the raw sign-in details needed for real-time risk evaluation. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) ensures that the authentication process flows through Azure AD directly, allowing Entra ID Protection to capture and analyze all sign-in events, including those from federated users.

Answer

Configure the federated trust in Microsoft Entra ID to use the new claims.

Answer

Configure ADFS to send the ipaddr and xms_ep claims to Azure AD.

Answer

Enable Azure AD Application Proxy to publish ADFS internally.

Question 20

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You need to protect a custom SaaS application that uses SAML-based SSO. The application does not support Conditional Access. You want to enforce session controls such as blocking downloads of sensitive files. What should you implement?

Accepted Answer

Deploy Microsoft Defender for Cloud Apps Conditional Access App Control and route the application through Defender for Cloud Apps.. Microsoft Defender for Cloud Apps Conditional Access App Control acts as a reverse proxy that can enforce session policies—such as blocking downloads of sensitive files—on any SAML-based SaaS application, even if the application itself does not support Conditional Access. By routing the application's traffic through Defender for Cloud Apps, you can apply granular session controls at the proxy layer without modifying the application.

Answer

Implement a reverse proxy from a third-party vendor.

Answer

Create a custom application registration and set app roles.

Answer

Configure the application to use Microsoft Entra ID as the identity provider and enable Conditional Access policies.