Implement and manage Microsoft Entra identity and access →hardMultiple Choice

MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Exhibit

Refer to the exhibit.

PowerShell output:

Get-AzureADDirectorySetting | Select-Object *

Id                                   : 1234-...
DisplayName                          : Group.Unified
TemplateId                           : 62375ab9-...
Values                               : {[EnableGroupCreation, true], [GroupCreationAllowedGroupId, ], [UsageGuidelinesUrl, ], [ClassificationDescriptions, ], [DefaultClassification, ], [PrefixSuffixNamingRequirement, ], [CustomBlockedWordsList, ], [EnableMSStandardBlockedWords, false]}

You are reviewing directory settings for Microsoft 365 Groups. Based on the exhibit, which statement is true?

⚠ Common exam trap

It's easy for candidates to assume a naming policy or classification label is always enforced for Microsoft 365 Groups, but the exhibit clearly shows no such configuration, and the question tests the ability to read the actual directory settings rather than relying on default assumptions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

All users in the tenant can create Microsoft 365 Groups

The exhibit shows that under 'Group creation settings,' the option 'Set which users can create Microsoft 365 Groups' is configured to 'Everyone.' This means all users in the tenant are permitted to create groups, regardless of membership in any security group. Therefore, option D is correct because the setting explicitly allows all users to create Microsoft 365 Groups.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Only users in a specific security group can create Microsoft 365 Groups
Why it's wrong here
The directory setting GroupCreationAllowedGroupId is used to limit Microsoft 365 Group creation to members of a specific security group. In this scenario, that setting is empty, so no such restriction is active. Therefore, group creation is not limited to a specified security group; all users can create groups.
✗
A naming policy is enforced for new groups
Why it's wrong here
A naming policy for Microsoft 365 Groups requires a PrefixSuffixNamingRequirement (such as a fixed prefix or suffix) and optionally blocked words. The reported setting shows PrefixSuffixNamingRequirement is empty, meaning no group name pattern is enforced. Thus, new groups are not subject to a naming policy, making this option incorrect.
✗
Groups must have a classification label
Why it's wrong here
Classification labels for Microsoft 365 Groups rely on the DefaultClassification directory setting to assign a default label when none is chosen. With DefaultClassification empty, groups are created without an automatic classification, and the policy does not require users to select one. Consequently, requiring a classification label is not in effect.
✓
All users in the tenant can create Microsoft 365 Groups
Why this is correct
The EnableGroupCreation directory setting is set to true, which is the master switch that permits group creation in the tenant. Because GroupCreationAllowedGroupId is also empty, there is no security-group scoping override. As a result, every user in the organization can create Microsoft 365 Groups.

Go deeper

MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question