MS-102 Implement and manage identity and access in Microsoft Entra ID — 30 Questions

Question 1

An organization has Microsoft Entra ID P2 licenses and wants to configure a Conditional Access policy to restrict access to Microsoft 365 services. Which of the following can be used as conditions in the policy? (Choose two that apply)

Accepted Answer

Device platform. Device platform is a valid condition in Microsoft Entra Conditional Access policies, allowing administrators to target specific operating systems such as Windows, macOS, iOS, or Android. This enables granular control over access based on the device type, which is essential for enforcing security requirements like requiring compliant devices on certain platforms.

Answer

Authentication strength

Answer

Application ID

Question 2

An organization with Microsoft Entra ID P2 licenses wants to require multi-factor authentication (MFA) for all users but allow them to register their authentication methods before being forced to use MFA. Which configuration should they implement?

Accepted Answer

Conditional Access policy with MFA grant and a registration campaign. Conditional Access policies can include a registration campaign for combined security info registration, allowing users to preregister MFA methods before the policy requiring MFA is enforced. This provides a smooth user experience. Security defaults enforce MFA immediately without a pre-registration period. Per-user MFA requires enabling MFA per user and does not include a registration campaign. Identity Protection user risk policy triggers MFA based on risk, not a blanket requirement.

Answer

Security defaults

Answer

Per-user MFA

Answer

Identity Protection user risk policy

Question 3

An organization wants to enforce that all administrators use a phishing-resistant authentication method (e.g., FIDO2 security keys or Windows Hello for Business) when accessing Microsoft 365 admin portals. Which Microsoft Entra ID feature should be used?

Accepted Answer

Conditional Access authentication strength. Option A is correct because Conditional Access authentication strength allows administrators to define and enforce specific authentication methods, such as FIDO2 security keys or Windows Hello for Business, which are phishing-resistant. By creating a policy that targets admin roles and requires an authentication strength policy that mandates these methods, the organization can ensure that only phishing-resistant credentials are accepted when accessing Microsoft 365 admin portals. This granular control goes beyond simple MFA enforcement by specifying the exact authentication method required.

Answer

Security defaults

Answer

Per-user MFA

Answer

Identity Protection

Question 4

An organization with Microsoft Entra ID P2 licenses needs to enforce that all users accessing the Azure portal must use FIDO2 security keys for multi-factor authentication. Which configuration should be implemented?

Accepted Answer

Configure an authentication strength policy that requires FIDO2 and assign it to a Conditional Access policy. Option C is correct because in Microsoft Entra ID, authentication strengths allow you to define a specific set of authentication methods (e.g., FIDO2 security keys) and then assign that strength to a Conditional Access policy. This ensures that only FIDO2 security keys are accepted for MFA when accessing the Azure portal, meeting the requirement precisely.

Answer

Create a Conditional Access policy that requires MFA and select FIDO2 as the authentication strength in the grant controls

Answer

Create a Conditional Access policy that requires MFA and set the grant control to require a specific device platform

Answer

Configure an authentication methods policy that allows only FIDO2 security keys

Question 5

An organization wants to enable users to reset their own passwords using the Microsoft Authenticator app and to prevent reuse of the last five passwords. Which Microsoft Entra ID features should be configured?

Accepted Answer

Self-Service Password Reset (SSPR) and Password Protection. The requirement to enable users to reset their own passwords via the Microsoft Authenticator app is fulfilled by Self-Service Password Reset (SSPR), which supports the Authenticator app as an authentication method. The requirement to prevent reuse of the last five passwords is fulfilled by Password Protection, specifically the password reuse policy within the custom banned password list or the enforcement of password history via on-premises integration. Option B correctly pairs these two features.

Answer

Microsoft Entra ID Protection and SSPR

Answer

Conditional Access and SSPR

Answer

Identity Governance and SSPR

Question 6

A company wants to ensure that all new users register for multi-factor authentication (MFA) within 14 days of account creation. Which Microsoft Entra ID feature should be used?

Accepted Answer

MFA registration campaign. The MFA registration campaign in Microsoft Entra ID is specifically designed to enforce user registration for MFA within a defined time frame, such as 14 days. It targets new users and sends them reminders to register, blocking access until registration is completed, which directly meets the company's requirement.

Answer

Conditional Access policy

Answer

Identity Protection

Answer

Access Reviews

Question 7

An organization has multiple Microsoft Entra ID tenants and wants to allow partner users to access internal applications using their own corporate credentials. Which feature should be used to enable this?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it allows partner users to access internal applications using their own corporate credentials (their home tenant identity) without requiring any external accounts or local user management. B2B collaboration uses cross-tenant trust relationships, enabling seamless single sign-on (SSO) via SAML/WS-Fed or OIDC protocols, which aligns with the requirement to use existing partner credentials.

Answer

Microsoft Entra B2C

Answer

Azure AD Connect

Answer

Tenant-to-tenant migration

Question 8

An organization uses Microsoft Entra ID. They want to ensure that users cannot install browser extensions from the Microsoft Edge Add-ons store on managed devices. Which Microsoft Entra ID feature should they use to enforce this policy?

Accepted Answer

Microsoft Entra ID device management with MDM/MAM policies. Microsoft Entra ID device management with MDM/MAM policies (Option C) is correct because browser extension restrictions for Microsoft Edge on managed devices are enforced through device compliance or app protection policies configured in Microsoft Intune, which is the core MDM/MAM service integrated with Entra ID. These policies can block installation from the Edge Add-ons store by using the 'Allow extensions from other stores' setting or by creating a custom OMA-URI policy to restrict extension installation. Conditional Access policies (Option A) control access based on signals like device compliance but cannot directly enforce device-level settings like browser extension installation.

Answer

Conditional Access policy

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management

Question 9

An organization uses Microsoft Entra ID P2 licenses. They want to implement a policy that forces users to perform multi-factor authentication (MFA) only when they sign in from an untrusted location. The trusted locations include the corporate office IP range. Which type of policy should they create?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow administrators to enforce MFA based on conditions like location. By configuring a policy that targets all users and cloud apps, with a condition excluding trusted IP ranges (corporate office), MFA is only triggered when sign-ins originate from untrusted locations. This is the precise mechanism for location-based MFA enforcement.

Answer

Identity Protection user risk policy

Answer

MFA registration policy

Answer

Authentication methods policy

Question 10

An organization uses Microsoft Entra ID with Pass-through Authentication (PTA) and Seamless Single Sign-On (SSO). They notice that password changes in on-premises Active Directory are not reflecting immediately in Microsoft Entra ID for some users. What is the most likely cause?

Accepted Answer

The user's password change has not replicated to all domain controllers. In a Pass-through Authentication environment, password changes are processed by on-premises Active Directory. The password change must replicate to all domain controllers before Microsoft Entra ID can authenticate the new password via the PTA agent. If replication is incomplete, the PTA agent may contact a domain controller that still has the old password, causing the delay.

Answer

The PTA agents are overloaded

Answer

The Seamless SSO feature is disabled

Answer

Microsoft Entra ID has a password hash sync delay

Question 11

A company uses Microsoft Entra ID with conditional access policies. They need to ensure that all external users who are invited via B2B collaboration must perform multi-factor authentication (MFA) when accessing the corporate SharePoint Online site. Which two configurations are required? (Choose two.)

Accepted Answer

Create a conditional access policy targeting all guest users, requiring MFA, and scope to SharePoint Online.. Option A is correct because a conditional access policy in Microsoft Entra ID can be configured to target 'Guest or external users' (the 'All guest users' scope) and require multi-factor authentication (MFA) when accessing SharePoint Online. This directly enforces MFA for B2B collaboration users accessing the corporate SharePoint site, as the policy is evaluated at the resource tenant (the tenant hosting SharePoint).

Answer

Configure the SharePoint Online external sharing settings to require MFA for guest users.

Answer

Set the guest user access level in the SharePoint admin center to require MFA.

Question 12

An organization wants to allow users to sign in to Microsoft 365 using their on-premises Active Directory credentials but does not want to synchronize password hashes to the cloud. They also want to eliminate the need for users to re-enter their credentials when accessing cloud resources from domain-joined devices. Which combination of authentication methods should they implement?

Accepted Answer

Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO). Pass-through Authentication (PTA) validates user passwords directly against on-premises Active Directory without storing password hashes in the cloud, satisfying the requirement to avoid hash synchronization. Seamless SSO eliminates the need for users to re-enter credentials on domain-joined devices by using Kerberos delegation to silently authenticate against Microsoft Entra ID, meeting both stated needs.

Answer

Federation with Active Directory Federation Services (AD FS)

Answer

Password Hash Sync (PHS) with Seamless SSO

Answer

Cloud-only authentication with MFA

Question 13

Contoso uses Microsoft Entra ID P1 licenses and has a dedicated corporate office with static public IP addresses. The company wants to require MFA for all users, but exempt users when they connect from the corporate office. Which configuration should the administrator implement?

Accepted Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and exclude the corporate office location from the policy.. Option B is correct because a Conditional Access policy can target all users, require MFA as a grant control, and exclude the corporate office location (defined by static public IP addresses as a named location). This ensures MFA is enforced for all connections except those originating from the trusted corporate network, aligning with the requirement to exempt users at the office.

Answer

Create a Conditional Access policy that targets all users, grant access requiring MFA, and include the corporate office location as a condition.

Answer

Configure a Per-User MFA policy and add the corporate office IPs to a list of trusted IPs in the MFA settings.

Answer

Create a Conditional Access policy that targets the corporate office location and grant access with MFA for all other locations.

Question 14

A company invites external partners as B2B guest users in Microsoft Entra ID. The partners' home tenants do not support MFA. The company wants to require MFA when guests access an internal application. What should the company configure?

Accepted Answer

Configure a Conditional Access policy that targets all guest users, require MFA, and enable MFA registration for guests in the resource tenant.. Option A is correct because when guest users' home tenants do not support MFA, the resource tenant must enforce MFA directly. A Conditional Access policy targeting all guest users with 'Require MFA' grant control, combined with enabling MFA registration for guests in the resource tenant, allows guests to register and use MFA methods (e.g., Microsoft Authenticator) within the resource tenant. This ensures MFA is enforced regardless of the home tenant's capabilities.

Answer

Ask the partners to configure MFA in their home tenant, then trust their MFA claims.

Answer

Use a Per-User MFA policy for guest users, but guests cannot register for MFA in the resource tenant.

Answer

Create a Conditional Access policy requiring MFA for all external users, but exclude guests from known networks.

Question 15

A company uses Microsoft Entra ID with password hash synchronization. The security team wants to prevent users from setting passwords that include their username or common terms from a custom dictionary (e.g., company name, product names). Which feature should be configured?

Accepted Answer

Configure a custom banned passwords list in Microsoft Entra ID Password Protection.. Option B is correct because Microsoft Entra ID Password Protection allows administrators to enforce custom banned password lists that prevent users from including specific terms (e.g., company name, product names) or their username in passwords. This feature works with password hash synchronization to block weak passwords at the cloud level, directly addressing the security team's requirement.

Answer

Enable Azure AD Identity Protection with user risk policies.

Answer

Set a fine-grained password policy in on-premises Active Directory and sync it to Azure AD.

Answer

Enable MFA registration campaign to force users to register for MFA.

Question 16

A company uses Microsoft Entra ID P2 licenses. They want to ensure that all users are forced to use MFA when accessing a SaaS application from non-corporate networks. Corporate networks are identified by a set of IP ranges. Service accounts must be excluded from this requirement. Which policy should be created?

Accepted Answer

Conditional Access policy with grant controls for MFA, targeting all users, with location condition to exclude trusted IPs, and exclude service accounts. A Conditional Access policy is the correct approach because it allows granular control over MFA enforcement based on network location and user exclusions. By targeting all users, excluding trusted IPs (corporate networks) via the location condition, and explicitly excluding service accounts, the policy ensures MFA is required only for non-corporate network access while bypassing service accounts. This aligns with the requirement to use Microsoft Entra ID P2 licenses, which include Conditional Access capabilities.

Answer

An Identity Protection user risk policy requiring MFA for medium and above risk users

Answer

An Identity Protection sign-in risk policy requiring MFA for medium and above risk sign-ins

Answer

Per-user MFA settings enabled for all users with trusted IPs configured in MFA service settings

Question 17

A company uses Microsoft Entra ID with Pass-through Authentication. The security team wants to block all sign-ins from countries that are not approved (e.g., high-risk regions). Which feature should they use?

Accepted Answer

Conditional Access policy with country location condition. Conditional Access policies in Microsoft Entra ID can include a location condition that uses IP addresses to determine the country of origin. By configuring a policy to block access from specific countries (e.g., high-risk regions), the security team can enforce this requirement. This is the correct feature because it directly evaluates the geographic location of the sign-in request and applies an access control (block) accordingly.

Answer

Identity Protection sign-in risk policy

Answer

Identity Protection user risk policy

Answer

Named locations with blocked countries

Question 18

A company has a hybrid identity with password hash synchronization. They want to ensure that any user whose account is disabled in on-premises Active Directory is automatically prevented from signing in to Microsoft 365. How can this be achieved?

Accepted Answer

Ensure Microsoft Entra Connect is configured to synchronize the disabled status; this happens automatically.. Option A is correct because Microsoft Entra Connect (formerly Azure AD Connect) by default synchronizes the `userAccountControl` attribute from on-premises Active Directory, which includes the disabled status (bit 2, ACCOUNTDISABLE). When an on-premises user account is disabled, the corresponding `accountEnabled` attribute in Microsoft Entra ID is set to `false`, preventing sign-in to Microsoft 365 without additional configuration.

Answer

Create a dynamic group based on accountEnabled attribute and apply a Conditional Access policy to block access.

Answer

Run a PowerShell script daily to disable matching accounts in Microsoft Entra ID.

Answer

Enable cloud HR provisioning.

Question 19

An organization uses Microsoft Entra ID P2 licenses. They need to require multi-factor authentication (MFA) for all users accessing a critical financial application, but they must exclude a set of service accounts that are members of the 'Service Accounts' group. Which policy should they create?

Accepted Answer

Conditional Access policy with a grant block requiring MFA and an exclude assignment for the 'Service Accounts' group.. Option A is correct because a Conditional Access policy allows you to grant access only when MFA is completed, and you can exclude specific groups like 'Service Accounts' from the policy. This ensures all users except the excluded service accounts are prompted for MFA when accessing the critical financial application. The grant block requiring MFA is the appropriate control for this scenario.

Answer

An Identity Protection user risk policy configured to require MFA for high-risk users.

Answer

Per-user MFA enforced on all users, then disabled for the service accounts individually.

Answer

Conditional Access sign-in risk policy requiring MFA for risky sign-ins.

Question 20

A company uses Password Hash Synchronization (PHS) to synchronize identities to Microsoft Entra ID. They want to enable users to access Microsoft 365 applications from their domain-joined work devices without being prompted to re-enter their credentials. Which feature should they enable in addition to PHS?

Accepted Answer

Seamless Single Sign-On. Seamless Single Sign-On (SSO) is the correct feature to enable alongside Password Hash Synchronization (PHS) because it allows users on domain-joined devices to automatically authenticate to Microsoft 365 applications without being prompted for credentials. It works by integrating with Kerberos authentication, using a computer account in the on-premises Active Directory to issue a Kerberos ticket that Microsoft Entra ID can validate, eliminating the need for re-authentication.

Answer

Pass-through Authentication

Answer

Azure AD Connect Health

Answer

Conditional Access