The answer is Microsoft Entra ID device management with MDM/MAM policies, because browser extension restrictions for Microsoft Edge on managed devices are enforced through device compliance or app protection policies configured in Microsoft Intune, which serves as the core MDM/MAM service integrated with Entra ID. These policies can block installations from the Edge Add-ons store by leveraging the 'Allow extensions from other stores' setting or by deploying a custom OMA-URI policy to restrict extension installation entirely. On the MS-102 exam, this question tests your understanding of where device-level configuration lives—it is not Conditional Access, which controls access based on signals like device compliance but cannot directly enforce local settings such as extension installation. A common trap is confusing Conditional Access with device management; remember that blocking extensions requires a policy pushed to the device, not a conditional gate. Memory tip: "Extensions are device settings, not access gates."
MS-102 Practice Question: Implement and manage identity and access in Microsoft Entra ID
This MS-102 practice question tests your understanding of implement and manage identity and access in microsoft entra id. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization uses Microsoft Entra ID. They want to ensure that users cannot install browser extensions from the Microsoft Edge Add-ons store on managed devices. Which Microsoft Entra ID feature should they use to enforce this policy?
Why wrong: Conditional Access policies control access based on conditions like location or device compliance, but they do not directly configure allowed browser extensions.
B
Microsoft Entra ID Identity Protection
Why wrong: Identity Protection is for detecting and responding to identity risks, not for managing device configurations like browser extensions.
C
Microsoft Entra ID device management with MDM/MAM policies
Device management policies via MDM (e.g., Intune) can enforce settings such as blocking browser extensions on managed devices.
D
Privileged Identity Management
Why wrong: PIM provides just-in-time administrative access and does not handle device configuration policies.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID device management with MDM/MAM policies
Microsoft Entra ID device management with MDM/MAM policies (Option C) is correct because browser extension restrictions for Microsoft Edge on managed devices are enforced through device compliance or app protection policies configured in Microsoft Intune, which is the core MDM/MAM service integrated with Entra ID. These policies can block installation from the Edge Add-ons store by using the 'Allow extensions from other stores' setting or by creating a custom OMA-URI policy to restrict extension installation. Conditional Access policies (Option A) control access based on signals like device compliance but cannot directly enforce device-level settings like browser extension installation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Conditional Access policy
Why it's wrong here
Conditional Access policies control access based on conditions like location or device compliance, but they do not directly configure allowed browser extensions.
✗
Microsoft Entra ID Identity Protection
Why it's wrong here
Identity Protection is for detecting and responding to identity risks, not for managing device configurations like browser extensions.
✓
Microsoft Entra ID device management with MDM/MAM policies
Why this is correct
Device management policies via MDM (e.g., Intune) can enforce settings such as blocking browser extensions on managed devices.
Related concept
Read the scenario before looking for a memorised answer.
✗
Privileged Identity Management
Why it's wrong here
PIM provides just-in-time administrative access and does not handle device configuration policies.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Conditional Access policies with device management policies, assuming that access controls can enforce device settings, when in fact Conditional Access only gates access based on existing device state and cannot push configuration changes.
Detailed technical explanation
How to think about this question
Under the hood, Microsoft Intune (the MDM authority for Entra ID) uses Configuration Service Provider (CSP) policies, specifically the 'Policy CSP - Browser' node, to control Microsoft Edge settings on Windows devices. For example, the 'ExtensionInstallBlocklist' and 'ExtensionInstallAllowlist' policies can be deployed via OMA-URI to block all extensions or allow only specific ones. In a real-world scenario, an organization might combine this with a Conditional Access policy requiring device compliance (e.g., 'Require device to be marked as compliant') to ensure only devices with the browser extension restriction can access corporate resources.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Implement and manage identity and access in Microsoft Entra ID — This question tests Implement and manage identity and access in Microsoft Entra ID — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Microsoft Entra ID device management with MDM/MAM policies — Microsoft Entra ID device management with MDM/MAM policies (Option C) is correct because browser extension restrictions for Microsoft Edge on managed devices are enforced through device compliance or app protection policies configured in Microsoft Intune, which is the core MDM/MAM service integrated with Entra ID. These policies can block installation from the Edge Add-ons store by using the 'Allow extensions from other stores' setting or by creating a custom OMA-URI policy to restrict extension installation. Conditional Access policies (Option A) control access based on signals like device compliance but cannot directly enforce device-level settings like browser extension installation.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.