MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
You need to ensure that only users from your organization's on-premises Active Directory can access Microsoft 365 services. You have Microsoft Entra Connect configured. What is the simplest way to prevent cloud-only user accounts from signing in?
⚠ Common exam trap
MS-102 often tests the difference between blocking sign-in for specific users versus conditional access policies; candidates may incorrectly choose a broad conditional access policy that blocks all users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the 'Block sign in' option to 'Yes' for all cloud-only users in the Microsoft Entra admin center.
Setting the 'Block sign in' option to 'Yes' for cloud-only users in the Microsoft Entra admin center directly prevents those accounts from signing in without deleting them or affecting licensed users. This is the simplest and most targeted method. It does not require conditional access policies or license changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a conditional access policy that blocks all users.
Why it's wrong here
A block-all policy denies every user, including the on-premises accounts that must retain access, so it fails the requirement. It is tempting because it is a single policy that stops cloud-only sign-in, and blocking all users is correct during a security incident or emergency lockdown.
- ✗
Delete the cloud-only users from Microsoft Entra ID.
Why it's wrong here
Deleting the accounts is destructive and irreversible, and newly created cloud-only accounts would still sign in, so it does not enforce an on-premises-only rule. It is tempting because it removes the unwanted identities outright, which is correct when accounts are genuinely obsolete rather than needing ongoing restriction.
- ✓
Set the 'Block sign in' option to 'Yes' for all cloud-only users in the Microsoft Entra admin center.
Why this is correct
Setting 'Block sign in' to Yes in Microsoft Entra ID directly prevents cloud-only accounts from authenticating, satisfying the requirement that only on-premises Active Directory users access Microsoft 365. Because Microsoft Entra Connect already synchronises those on-premises identities, blocking the cloud-only accounts leaves synced users unaffected, and it is the simplest per-account control available.
- ✗
Remove all licenses from cloud-only users.
Why it's wrong here
Removing licences blocks access to licensed services but leaves the accounts able to sign in to Microsoft Entra ID itself, so it does not prevent cloud-only sign-in. It is tempting because it revokes service access, which is the right approach when deprovisioning a departing user rather than restricting authentication origin.
Go deeper
Related to this question
Learn chapter
Entra Connect Sync Rules and Filtering
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.