MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
A new employee has been hired and their account already exists in the on-premises Active Directory. The administrator needs to provide the employee with access to Microsoft 365 services as quickly as possible. What is the most efficient way to enable the user?
⚠ Common exam trap
Many candidates confuse the speed of creating a new cloud user (Option A) with the efficiency of leveraging an existing synchronized identity, failing to recognize that synchronization is the intended and fastest path for hybrid environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sync the on-premises user using Azure AD Connect and then assign the license.
The user already exists in on-premises Active Directory, and the fastest way to enable Microsoft 365 access is to synchronize that identity using Azure AD Connect. Once synchronized, the user object appears in Microsoft Entra ID (formerly Azure AD), and the administrator can immediately assign a license without re-creating the account. This avoids the delays of manual creation or guest invitations and leverages the existing identity lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new cloud-only user in the Microsoft 365 admin center and assign a license.
Why it's wrong here
Creating a new cloud-only user for an employee who already exists on-premises creates a duplicate identity that is not linked to the on-premises AD. Because Azure AD Connect uses sourceAnchor to map identities, this cloud-only user will never match the synced on-premises object, so password changes, group memberships, and attribute updates from on-premises will not flow to the new account. You end up with two separate identities for the same person, requiring double administration and increasing the risk of access inconsistencies.
- ✓
Sync the on-premises user using Azure AD Connect and then assign the license.
Why this is correct
Synchronize the existing on-premises user using Microsoft Entra Connect (formerly Azure AD Connect), which creates a user object in Microsoft Entra ID with the correct sourceAnchor for a stable, immutable link. This ensures the cloud identity is the same as the on-premises identity, enabling password hash sync or pass-through authentication for unified credentials. After the user is synced and visible in the portal, assign the required Microsoft 365 license to activate services like Exchange Online and Teams, preserving a single source of identity authority.
- ✗
Manually create a user in Microsoft Entra ID with the same name and assign license.
Why it's wrong here
Manually creating a user directly in Microsoft Entra ID with the same name is functionally similar to creating a cloud-only user, but it adds a risk of collision: when the on-premises user is later synchronized, the UPN may conflict with the manually created object. The soft-match process may fail if sourceAnchor does not match, leading to duplicate objects or a permanent synchronization error. Even if the UPN matches, the manually created object is not linked to the on-premises directory and will be overwritten or orphaned by the sync engine, making this approach inefficient and prone to administrative errors.
- ✗
Use Azure AD B2B collaboration to invite the on-premises user as a guest.
Why it's wrong here
Azure AD B2B collaboration is designed for inviting external partners and guests, not for provisioning employees who already exist in the on-premises directory. Inviting the on-premises user as a guest creates an external identity that lacks member-level privileges, so it cannot be assigned the same licenses or access rights as an internal employee. Guest accounts do not integrate with on-premises AD and are subject to external-identity conditional access policies, meaning the user would not get an employee mailbox, OneDrive, or internal collaboration features, and the invitation does not consume a Microsoft 365 license properly.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Azure AD Connect
Azure AD Connect is a Microsoft tool that synchronizes on-premises Active Directory identities with Azure Active Directory for unified cloud and on-premises access.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.