MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The user does not have the Global Administrator role.

  Why it's wrong here

  This option mistakes a filter result for an entitlement fact. In Microsoft 365 Defender, the IdentityInfo table contains one normalized record per discovered identity, including role memberships collected from Active Directory and Azure AD. If the user were present but lacked the Global Administrator role, the row would still exist (with other roles or an empty role list); the query's role filter would simply not select it. An empty result therefore indicates that no identity record for this user reached the table, not that the user lacks the role.

• ✗

  The KQL query syntax is invalid.

  Why it's wrong here

  If the query were syntactically invalid, KQL would return an error banner and the investigation page would not display an empty results set. The syntax shown—using `let` to define a variable followed by a pipeline of operators—is structurally valid and runs successfully. An empty result set proves the query was accepted by the parser; otherwise the tool would have raised a syntax error before returning any data. Thus syntax is definitely not the cause of the missing results.

• ✗

  The role name in the query is misspelled.

  Why it's wrong here

  The literal 'Global Administrator' is the exact display name stored in the role property of IdentityInfo and matches the role name used in Azure AD, so it is not misspelled. Even if a typo existed, the query would still return an empty result, but the underlying identity record would remain in the table; the correct diagnostic distinction is whether IdentityInfo has any rows at all. If the table were populated, a typo would yield no matches, yet you could still see the user by querying without the role filter. Since no user is returned even in a broader query, the spelling is a red herring.

• ✓

  Microsoft Defender for Identity is not enabled for the tenant.

  Why this is correct

  IdentityInfo is not derived from the Microsoft Graph or role directory alone; it is continuously synchronized by Microsoft Defender for Identity (MDI) sensors from on-premises Active Directory and Azure AD. MDI enriches identities with role, group, and resource access data. When MDI is not onboarded or properly licensed, the IdentityInfo table remains empty or contains only incomplete data, so any query filtering it returns no rows. This is the root cause consistent with an empty result set and a valid query, making it the only correct answer here.

Go deeper

Related to this question