MS-102 Manage users, groups, licensing, and support — Timed 15 Questions

Question 1

A company has a Microsoft 365 E5 subscription. The security team requires that all guest users must have terms of use acceptance before accessing resources. Which Azure AD feature should be configured?

Accepted Answer

Azure AD Terms of Use. Azure AD Terms of Use (ToU) is the correct feature because it allows administrators to present a document to guest users that they must accept before accessing resources. This directly meets the security team's requirement for mandatory terms of use acceptance. Conditional Access policies can enforce ToU acceptance, but the ToU document itself is created and managed under the Azure AD Terms of Use blade.

Answer

Conditional Access policy

Answer

Azure AD Identity Protection

Answer

Self-service password reset

Question 2

A user reports they cannot access SharePoint Online but can access Outlook. The admin verifies the user has an E3 license assigned. What is the most likely cause?

Accepted Answer

SharePoint Online service plan is disabled. The user can access Outlook (Exchange Online) but not SharePoint Online, which indicates that the user's E3 license is assigned and the account is active. The most likely cause is that the SharePoint Online service plan within the E3 license is disabled. Each Microsoft 365 license includes multiple service plans (e.g., Exchange Online, SharePoint Online, Teams), and an admin can disable individual plans while keeping the license assigned. If the SharePoint Online service plan is disabled, the user will be blocked from accessing SharePoint Online despite having a valid license.

Answer

License not assigned

Answer

MFA challenge failing

Answer

User account is disabled

Question 3

A company uses dynamic groups based on department attribute. A user moved from Sales to Marketing but the group membership did not update after 48 hours. What should the admin do first?

Accepted Answer

Manually refresh the dynamic group in Azure AD. Option D is correct because Azure AD dynamic group membership evaluation is not instantaneous; it occurs on a periodic schedule. When a user's attribute changes, the admin can manually trigger a refresh by selecting 'Refresh' on the dynamic group's overview page in the Azure portal, which forces an immediate evaluation of the membership rules. This is the first troubleshooting step before waiting longer or using other methods.

Answer

Delete and recreate the group

Answer

Run a PowerShell script to update membership

Answer

Wait another 24 hours

Question 4

An organization wants to delegate user creation to help desk staff without granting global admin rights. Which role should be assigned?

Accepted Answer

User Administrator. The User Administrator role is the correct choice because it grants the specific permissions needed to create and manage users and groups, including resetting passwords, without the broad privileges of Global Administrator. This role aligns with the principle of least privilege for help desk staff who need to perform user creation tasks.

Answer

Global Administrator

Answer

Helpdesk Administrator

Answer

License Administrator

Question 5

A company needs to ensure that only users from specific IP ranges can access Exchange Online. Which tool should be used?

Accepted Answer

Azure AD Conditional Access with Named Locations. Azure AD Conditional Access with Named Locations is the correct tool because it allows administrators to define trusted IP ranges as named locations and then enforce access policies that restrict Exchange Online access to only those IP ranges. This integrates directly with Azure AD authentication, evaluating the user's IP address during sign-in to grant or block access based on the policy.

Answer

Security & Compliance Center

Answer

Multi-factor authentication

Answer

Azure AD Connect

Question 6

A user with an E5 license is unable to use Azure Information Protection (AIP). The admin confirms the license is assigned. What is the most likely cause?

Accepted Answer

AIP service plan is disabled in the license. Even with an E5 license assigned, the Azure Information Protection (AIP) service plan must be explicitly enabled for the user. By default, some service plans within an E5 license may be disabled, and the AIP service plan (commonly labeled as 'Azure Information Protection' or 'Information Protection for Office 365') must be toggled on in the user's license settings in the Microsoft 365 admin center. Without this, the user cannot activate AIP features regardless of license assignment.

Answer

AIP requires an additional subscription

Answer

AIP client is not installed

Answer

User account is blocked

Question 7

An admin needs to bulk assign licenses to 200 users based on department. Which method is most efficient?

Accepted Answer

Use group-based licensing in Azure AD. Group-based licensing in Azure AD is the most efficient method for bulk-assigning licenses to 200 users based on department because it automates license assignment and removal based on group membership. Once a user is added to or removed from a department-specific group, Azure AD automatically applies or revokes the corresponding license, eliminating manual intervention and ensuring consistency across large-scale deployments.

Answer

Use Azure AD PowerShell script

Answer

Use Azure admin center bulk operations

Answer

Assign licenses one by one in admin center

Question 8

A company has a hybrid identity setup. A new employee is created in on-premises AD but does not appear in Azure AD after sync. What should the admin check first?

Accepted Answer

Azure AD Connect synchronization status. When a new user is created in on-premises Active Directory but does not appear in Azure AD after synchronization, the first troubleshooting step is to check the Azure AD Connect synchronization status. This is because Azure AD Connect is the service responsible for synchronizing objects from on-premises AD to Azure AD, and any sync failure, delay, or misconfiguration (such as a stopped sync cycle or filtering rules) would prevent the user from appearing. Checking the sync status via the Azure AD Connect wizard or the Synchronization Service Manager can immediately reveal whether the object was exported, skipped, or errored.

Answer

Organizational unit filtering

Answer

DNS configuration

Answer

License assignment

Question 9

An organization needs to restrict access to Microsoft 365 admin center to only specific users. Which approach should be used?

Accepted Answer

Create a Conditional Access policy targeting the Microsoft Admin Portals cloud app. Option B is correct because a Conditional Access policy targeting the 'Microsoft Admin Portals' cloud app allows granular control over which users can access the Microsoft 365 admin center. This policy can enforce conditions such as user/group membership, device compliance, or location to restrict access, ensuring only specific authorized users can reach the admin portals.

Answer

Enable MFA for all admins

Answer

Assign Global Admin role only to required users

Answer

Use Privileged Identity Management

Question 10

A user reports that after changing their department in HR system, the change did not reflect in Azure AD dynamic group membership. The sync from HR to Azure AD is working. What is the most likely issue?

Accepted Answer

Dynamic group membership evaluation delay. Dynamic group membership in Azure AD is not updated in real time; it can take up to 30 minutes for a user attribute change to trigger a membership reevaluation. Since the HR-to-Azure AD sync is confirmed working, the delay is the most likely cause, not a failure in attribute synchronization or licensing.

Answer

License not assigned

Answer

Group is a mail-enabled security group

Answer

Attribute not synced to Azure AD

Question 11

An admin needs to provide a vendor with temporary access to a SharePoint site. What should the admin create?

Accepted Answer

Guest user in Azure AD. A is correct because creating a guest user in Azure AD is the proper method to grant external users access to SharePoint Online resources with controlled permissions. Guest users are invited via Azure AD B2B collaboration, which allows the admin to assign specific SharePoint site permissions while maintaining oversight and the ability to revoke access. This approach ensures the vendor has a distinct identity for auditing and conditional access policies.

Answer

Anonymous sharing link

Answer

Security group

Answer

New user in your domain

Question 12

Which TWO actions can an admin take to reduce the number of passwords in use for end users?

Accepted Answer

Enable Windows Hello for Business. Windows Hello for Business replaces traditional password authentication with strong two-factor authentication tied to a user's device, using biometrics or a PIN. This directly reduces the reliance on passwords for end users by enabling passwordless sign-in to Windows devices and integrated applications.

Answer

Enforce complex password policies

Answer

Configure self-service password reset

Answer

Implement password hash sync

Question 13

Which THREE conditions can be used in a dynamic group rule for a device?

Accepted Answer

deviceModel. Option A is correct because `deviceModel` is a valid attribute that can be used in a dynamic group rule for devices in Microsoft Entra ID (formerly Azure AD). Dynamic group rules for devices support attributes such as `deviceModel`, `deviceCategory`, and `deviceOSVersion` to automatically include or exclude devices based on their hardware or software characteristics.

Answer

lastLogonTimestamp

Answer

passwordLastSet

Question 14

Which TWO roles can manage user licenses without being able to create users?

Accepted Answer

License Administrator. The License Administrator role in Microsoft 365 is specifically designed to allow users to manage licenses assigned to users and groups without having permissions to create new user accounts. This role grants access to the Microsoft 365 admin center's Billing > Licenses section and the Azure AD Licenses blade, enabling license assignment, removal, and consumption monitoring, but it explicitly excludes user creation or deletion capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 15

Which THREE steps are required to enable group-based licensing?

Accepted Answer

Add members to the group. Option B is correct because group-based licensing in Azure AD requires that you add members to the security group that will have the license assigned. Without members, the license assignment has no effect, as the license is applied to all users in the group. This step ensures that the intended users receive the license automatically based on group membership.

Answer

Configure Azure AD Connect

Answer

Ensure group is mail-enabled