MS-102 Manage users, groups, licensing, and support — 20 Questions

Question 1

A company has a Microsoft 365 E5 subscription. The security team requires that all guest users must have terms of use acceptance before accessing resources. Which Azure AD feature should be configured?

Accepted Answer

Azure AD Terms of Use. Azure AD Terms of Use (ToU) is the correct feature because it allows administrators to present a document to guest users that they must accept before accessing resources. This directly meets the security team's requirement for mandatory terms of use acceptance. Conditional Access policies can enforce ToU acceptance, but the ToU document itself is created and managed under the Azure AD Terms of Use blade.

Answer

Conditional Access policy

Answer

Azure AD Identity Protection

Answer

Self-service password reset

Question 2

A user reports they cannot access SharePoint Online but can access Outlook. The admin verifies the user has an E3 license assigned. What is the most likely cause?

Accepted Answer

SharePoint Online service plan is disabled. The user can access Outlook (Exchange Online) but not SharePoint Online, which indicates that the user's E3 license is assigned and the account is active. The most likely cause is that the SharePoint Online service plan within the E3 license is disabled. Each Microsoft 365 license includes multiple service plans (e.g., Exchange Online, SharePoint Online, Teams), and an admin can disable individual plans while keeping the license assigned. If the SharePoint Online service plan is disabled, the user will be blocked from accessing SharePoint Online despite having a valid license.

Answer

License not assigned

Answer

MFA challenge failing

Answer

User account is disabled

Question 3

A company uses dynamic groups based on department attribute. A user moved from Sales to Marketing but the group membership did not update after 48 hours. What should the admin do first?

Accepted Answer

Manually refresh the dynamic group in Azure AD. Option D is correct because Azure AD dynamic group membership evaluation is not instantaneous; it occurs on a periodic schedule. When a user's attribute changes, the admin can manually trigger a refresh by selecting 'Refresh' on the dynamic group's overview page in the Azure portal, which forces an immediate evaluation of the membership rules. This is the first troubleshooting step before waiting longer or using other methods.

Answer

Delete and recreate the group

Answer

Run a PowerShell script to update membership

Answer

Wait another 24 hours

Question 4

An organization wants to delegate user creation to help desk staff without granting global admin rights. Which role should be assigned?

Accepted Answer

User Administrator. The User Administrator role is the correct choice because it grants the specific permissions needed to create and manage users and groups, including resetting passwords, without the broad privileges of Global Administrator. This role aligns with the principle of least privilege for help desk staff who need to perform user creation tasks.

Answer

Global Administrator

Answer

Helpdesk Administrator

Answer

License Administrator

Question 5

A company needs to ensure that only users from specific IP ranges can access Exchange Online. Which tool should be used?

Accepted Answer

Azure AD Conditional Access with Named Locations. Azure AD Conditional Access with Named Locations is the correct tool because it allows administrators to define trusted IP ranges as named locations and then enforce access policies that restrict Exchange Online access to only those IP ranges. This integrates directly with Azure AD authentication, evaluating the user's IP address during sign-in to grant or block access based on the policy.

Answer

Security & Compliance Center

Answer

Multi-factor authentication

Answer

Azure AD Connect

Question 6

A user with an E5 license is unable to use Azure Information Protection (AIP). The admin confirms the license is assigned. What is the most likely cause?

Accepted Answer

AIP service plan is disabled in the license. Even with an E5 license assigned, the Azure Information Protection (AIP) service plan must be explicitly enabled for the user. By default, some service plans within an E5 license may be disabled, and the AIP service plan (commonly labeled as 'Azure Information Protection' or 'Information Protection for Office 365') must be toggled on in the user's license settings in the Microsoft 365 admin center. Without this, the user cannot activate AIP features regardless of license assignment.

Answer

AIP requires an additional subscription

Answer

AIP client is not installed

Answer

User account is blocked

Question 7

An admin needs to bulk assign licenses to 200 users based on department. Which method is most efficient?

Accepted Answer

Use group-based licensing in Azure AD. Group-based licensing in Azure AD is the most efficient method for bulk-assigning licenses to 200 users based on department because it automates license assignment and removal based on group membership. Once a user is added to or removed from a department-specific group, Azure AD automatically applies or revokes the corresponding license, eliminating manual intervention and ensuring consistency across large-scale deployments.

Answer

Use Azure AD PowerShell script

Answer

Use Azure admin center bulk operations

Answer

Assign licenses one by one in admin center

Question 8

A company has a hybrid identity setup. A new employee is created in on-premises AD but does not appear in Azure AD after sync. What should the admin check first?

Accepted Answer

Azure AD Connect synchronization status. When a new user is created in on-premises Active Directory but does not appear in Azure AD after synchronization, the first troubleshooting step is to check the Azure AD Connect synchronization status. This is because Azure AD Connect is the service responsible for synchronizing objects from on-premises AD to Azure AD, and any sync failure, delay, or misconfiguration (such as a stopped sync cycle or filtering rules) would prevent the user from appearing. Checking the sync status via the Azure AD Connect wizard or the Synchronization Service Manager can immediately reveal whether the object was exported, skipped, or errored.

Answer

Organizational unit filtering

Answer

DNS configuration

Answer

License assignment

Question 9

An organization needs to restrict access to Microsoft 365 admin center to only specific users. Which approach should be used?

Accepted Answer

Create a Conditional Access policy targeting the Microsoft Admin Portals cloud app. Option B is correct because a Conditional Access policy targeting the 'Microsoft Admin Portals' cloud app allows granular control over which users can access the Microsoft 365 admin center. This policy can enforce conditions such as user/group membership, device compliance, or location to restrict access, ensuring only specific authorized users can reach the admin portals.

Answer

Enable MFA for all admins

Answer

Assign Global Admin role only to required users

Answer

Use Privileged Identity Management

Question 10

A user reports that after changing their department in HR system, the change did not reflect in Azure AD dynamic group membership. The sync from HR to Azure AD is working. What is the most likely issue?

Accepted Answer

Dynamic group membership evaluation delay. Dynamic group membership in Azure AD is not updated in real time; it can take up to 30 minutes for a user attribute change to trigger a membership reevaluation. Since the HR-to-Azure AD sync is confirmed working, the delay is the most likely cause, not a failure in attribute synchronization or licensing.

Answer

License not assigned

Answer

Group is a mail-enabled security group

Answer

Attribute not synced to Azure AD

Question 11

An admin needs to provide a vendor with temporary access to a SharePoint site. What should the admin create?

Accepted Answer

Guest user in Azure AD. A is correct because creating a guest user in Azure AD is the proper method to grant external users access to SharePoint Online resources with controlled permissions. Guest users are invited via Azure AD B2B collaboration, which allows the admin to assign specific SharePoint site permissions while maintaining oversight and the ability to revoke access. This approach ensures the vendor has a distinct identity for auditing and conditional access policies.

Answer

Anonymous sharing link

Answer

Security group

Answer

New user in your domain

Question 12

Which TWO actions can an admin take to reduce the number of passwords in use for end users?

Accepted Answer

Enable Windows Hello for Business. Windows Hello for Business replaces traditional password authentication with strong two-factor authentication tied to a user's device, using biometrics or a PIN. This directly reduces the reliance on passwords for end users by enabling passwordless sign-in to Windows devices and integrated applications.

Answer

Enforce complex password policies

Answer

Configure self-service password reset

Answer

Implement password hash sync

Question 13

Which THREE conditions can be used in a dynamic group rule for a device?

Accepted Answer

deviceModel. Option A is correct because `deviceModel` is a valid attribute that can be used in a dynamic group rule for devices in Microsoft Entra ID (formerly Azure AD). Dynamic group rules for devices support attributes such as `deviceModel`, `deviceCategory`, and `deviceOSVersion` to automatically include or exclude devices based on their hardware or software characteristics.

Answer

lastLogonTimestamp

Answer

passwordLastSet

Question 14

Which TWO roles can manage user licenses without being able to create users?

Accepted Answer

License Administrator. The License Administrator role in Microsoft 365 is specifically designed to allow users to manage licenses assigned to users and groups without having permissions to create new user accounts. This role grants access to the Microsoft 365 admin center's Billing > Licenses section and the Azure AD Licenses blade, enabling license assignment, removal, and consumption monitoring, but it explicitly excludes user creation or deletion capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 15

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Option B is correct because group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled

Question 16

You are the Microsoft 365 administrator for Contoso Ltd., a company with 500 users. The company uses a hybrid identity with Azure AD Connect. You have a dynamic group named 'SalesGroup' that includes all users with department attribute equal to 'Sales'. Recently, the HR system updated the department for 20 users from 'Sales' to 'Marketing'. The Azure AD Connect sync completed successfully, and the attribute changes are reflected in Azure AD. However, after 48 hours, these users are still members of 'SalesGroup'. You need to ensure that the group membership accurately reflects the department attribute within the next hour. The solution must use minimal administrative effort. What should you do?

Accepted Answer

Trigger a manual evaluation of the dynamic group in Azure AD. Option C is correct because Azure AD dynamic groups are not automatically re-evaluated immediately after a sync; they rely on a periodic background evaluation process that can take up to 24 hours. By triggering a manual evaluation in the Azure AD admin center or via PowerShell (using the `Invoke-MgGraphRequest` or `Update-MgGroup` cmdlet), you force an immediate recalculation of group membership based on the current attribute values, ensuring the 20 users are removed from SalesGroup within the hour with minimal administrative effort.

Answer

Remove the users from the group manually

Answer

Delete and recreate the dynamic group with the same rule

Answer

Wait another 24 hours for the next automatic evaluation

Question 17

You are the Microsoft 365 administrator for Fabrikam Inc., a company with 1,000 users. You have been asked to delegate the ability to reset passwords for all users to the help desk team. The help desk team consists of five users. You want to grant them the minimum necessary permissions. Additionally, you need to ensure that the help desk team can only reset passwords for users in the 'Users' organizational unit (OU) in on-premises Active Directory. The company uses Azure AD Connect with password hash sync. You create a security group named 'HelpDeskGroup' and add the help desk users to it. What should you do next?

Accepted Answer

Assign the Helpdesk Administrator role to the group and create an administrative unit scoped to the Users OU. Option C is correct because the Helpdesk Administrator role provides the least-privilege permissions for password resets, and creating an administrative unit (AU) scoped to the 'Users' OU allows you to restrict the role's management scope to only those users synced from that specific on-premises OU. This combination meets the requirement to delegate password reset with minimal permissions and scope limitation.

Answer

Assign the Global Administrator role to the group

Answer

Assign the User Administrator role to the group

Answer

Assign the Password Administrator role to the group and configure Azure AD Connect to restrict OU

Question 18

A company is deploying Microsoft 365 and wants to ensure that users in the finance department have access to only the apps they need. You need to recommend a licensing strategy that minimizes administrative overhead while enforcing access restrictions. What should you do?

Accepted Answer

Create a dynamic Azure AD group based on department attribute and assign licenses using group-based licensing.. Option B is correct because using a dynamic Azure AD group based on the department attribute automates membership updates as users change departments, and group-based licensing assigns the appropriate licenses to all members without manual intervention. This minimizes administrative overhead by eliminating the need to manually add or remove users from the group or assign licenses individually, while enforcing access restrictions by ensuring only finance users receive the licensed apps.

Answer

Create a security group with explicit membership and assign licenses to the group.

Answer

Assign licenses to users one by one in the Microsoft 365 admin center.

Answer

Use PowerShell to assign licenses based on user department attribute.

Question 19

You are troubleshooting a user who reports that they cannot access Microsoft Teams. The user has an E3 license assigned, but Teams is grayed out in the app launcher. You verify that the user is assigned the correct license and that the service plan for Teams is enabled. What is the most likely cause?

Accepted Answer

The user has been blocked from signing in to Microsoft Teams in the Microsoft 365 admin center.. Option A is correct because even if the license and service plan are enabled, the user might be blocked from the service via the admin center's user settings. Option B is wrong because the license is assigned. Option C is wrong because the service plan is enabled. Option D is wrong because the issue is specific to Teams, not all services.

Answer

The user does not have a valid email address.

Answer

The Teams service plan is disabled in the license.

Answer

The user's license has expired.

Question 20

Which TWO actions can a Microsoft 365 global administrator perform in the Microsoft 365 admin center to manage user accounts? (Choose two.)

Accepted Answer

Assign admin roles to a user.. In the Microsoft 365 admin center, a global administrator can assign admin roles to a user by navigating to Active users, selecting the user, and choosing 'Manage roles'. This is a core identity management task that allows delegation of administrative privileges within the tenant. Option C is also correct because resetting a user's password is a standard user management action available in the same interface.

Answer

Recover a deleted user account.

Answer

Manage the service health of Microsoft 365.

Answer

Create mailbox delegation permissions.