Describe the capabilities of Microsoft Entra practice questions

MFA registration policy

Why it fails: The MFA registration policy in Microsoft Entra ID Protection is designed to proactively ensure users register at least one multi-factor authentication method. While essential for strengthening overall security posture, this policy does not dynamically respond to detected sign-in or user risk levels. Its function is solely to enforce the initial setup of MFA, not to block access or remediate compromised accounts based on real-time risk assessments.

Conditional Access policy with a custom block rule

Why it fails: While Conditional Access policies are powerful for enforcing access controls, relying on a custom block rule for risk-based scenarios is less optimal when Microsoft Entra ID Protection is available. ID Protection's dedicated risk policies offer integrated, dynamic detection and automated responses for sign-in and user risks. A custom Conditional Access rule would require manual definition of risk conditions, lacking the native intelligence and seamless integration provided by ID Protection's specialized risk engine for comprehensive remediation.

Sign-in risk

Why it fails: Sign-in risk is a Conditional Access condition that leverages Microsoft Entra ID Protection's real-time and offline risk detections to identify suspicious sign-in attempts. While a powerful security control, this condition specifically focuses on the *likelihood* of a sign-in not being performed by the legitimate user, rather than the *origin* or *configuration* of the access attempt. The question's requirements do not indicate a need for risk-based access, making this option less relevant than location or device state for typical access control scenarios.

Application

Why it fails: "Application" is not a *condition* within a Conditional Access policy but rather a core *assignment* component, specifically found under "Cloud apps or actions." This assignment defines *which* cloud applications or user actions the policy will target, such as Microsoft 365, Salesforce, or specific custom applications. Conditions, conversely, specify *when* the policy applies based on attributes like user group membership, device state, or network location, not the resource being accessed itself.

Conditions

Why it fails: Conditions scope who, what, where and risk, but they cannot themselves deny access; the block lives in Access controls. Conditions tempt because sign-in risk is configured there, and they would be correct for defining which risk levels the policy evaluates.

Assignments

Why it fails: Assignments select users, groups, target resources and client apps, not the grant or block outcome. They tempt because the finance app and outside-network users are assigned there, and assignments would be correct for scoping which identities and applications the policy covers.

Session controls

Why it fails: Session controls govern in-session behaviour such as sign-in frequency, app-enforced restrictions and token protection, not the initial allow or block decision. They tempt because they appear alongside grant controls, and would be correct for limiting what an already-admitted session can do.

Grant control: Require MFA

Why it fails: The 'Require MFA' grant control forces MFA for every sign-in that matches the policy conditions. It does not allow periodic re-authentication; it always requires MFA.

Conditions: Device state

Why it fails: The device state condition is used to include or exclude devices based on compliance status, but it does not control the frequency of authentication. It identifies which devices the policy applies to.

Session control: Application restrictions

Why it fails: Application restrictions session control is used to enforce application-level policies, such as blocking downloads or limiting access to certain apps. It does not affect authentication frequency.

Microsoft Entra ID B2B collaboration

Why it fails: Microsoft Entra ID B2B collaboration is designed for inviting external users from partner organizations to access internal resources, typically using their existing work or school accounts. It facilitates collaboration between businesses rather than managing consumer identities for public-facing applications, and does not natively support social identity providers for customer sign-ups.

Microsoft Entra ID Identity Protection

Why it fails: Microsoft Entra ID Identity Protection is a security feature focused on detecting and remediating identity-based risks within an existing Entra ID tenant. It analyzes sign-in behaviors and user accounts for vulnerabilities and suspicious activity, but it does not provide the foundational identity management or federation services required to enable external customers to sign in to a custom application.

Microsoft Entra ID Conditional Access

Why it fails: Microsoft Entra ID Conditional Access enforces policies that control access to resources based on various conditions like user, device, location, and application. While essential for securing access, it acts as an authorization engine *after* a user has been authenticated by an identity provider, and therefore does not manage external identity providers or facilitate the initial federation for customer sign-in.

Identity Protection

Why it fails: Microsoft Entra ID Protection is primarily designed to detect and remediate identity-based risks, such as suspicious sign-ins, leaked credentials, or anomalous behavior. While it can trigger Conditional Access policies to enforce MFA based on risk, it does not directly facilitate Just-In-Time (JIT) administrative access with approval workflows. Furthermore, Identity Protection does not manage the combined registration process for Self-Service Password Reset (SSPR) and Multi-Factor Authentication (MFA).

Conditional Access

Why it fails: Conditional Access policies evaluate specific conditions like user, device, location, and application to enforce access controls, including requiring Multi-Factor Authentication (MFA) for certain scenarios. However, it is a policy enforcement engine, not a mechanism for Just-In-Time (JIT) role activation with approval workflows for privileged roles. Conditional Access also does not directly manage or enforce the combined registration experience for SSPR and MFA; it can only require MFA *after* a user attempts to sign in or access a resource.

Microsoft Entra Connect Sync (older version)

Why it fails: Microsoft Entra Connect Sync (older version) refers to previous iterations of the synchronization engine, which are no longer supported or recommended for new deployments. Using an outdated version would expose the client to potential security vulnerabilities, lack critical new features, and prevent access to current support and bug fixes. Best practice for any new migration dictates utilizing the latest stable release of Microsoft Entra Connect to ensure optimal performance and security.

Microsoft Graph API with custom sync script

Why it fails: The Microsoft Graph API is primarily an interface for programmatic access to Microsoft 365 and Microsoft Entra ID data, allowing applications to read and write directory objects. While it can be used to manage individual users or groups, it is not designed as a robust, continuous identity synchronization engine for an entire on-premises Active Directory. Implementing a custom sync script via Graph API would require extensive development, maintenance, and error handling, making it an impractical and non-standard solution for enterprise-level identity synchronization.

Microsoft Entra Connect Provisioning Agent

Why it fails: The Microsoft Entra Connect Provisioning Agent is specifically designed for Microsoft Entra Connect cloud sync, which is a lightweight agent-based solution for synchronizing users from disconnected on-premises Active Directory forests to Microsoft Entra ID, or for application provisioning. While it performs synchronization, it is not the standard tool for a typical, full-featured hybrid identity deployment involving password hash synchronization from a single, connected on-premises AD. Its capabilities and deployment model differ from the comprehensive Microsoft Entra Connect for this specific migration scenario.

Privileged Identity Management

Why it fails: Microsoft Entra Privileged Identity Management (PIM) enables organizations to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. PIM focuses on providing just-in-time (JIT) access, approval workflows, and access reviews for privileged roles, minimizing the attack surface associated with standing administrative permissions. Its scope is strictly limited to identity and access management for roles and does not extend to managing device configurations, enforcing application installation policies, or restricting access to app stores.

Multifactor authentication

Why it fails: Multifactor authentication (MFA) enhances security by requiring users to provide two or more verification factors to gain access to a resource, such as a password combined with a fingerprint or a code from an authenticator app. Its primary function is to verify the user's identity during the sign-in process, significantly reducing the risk of unauthorized access due to compromised credentials. However, MFA is an authentication mechanism and does not provide any controls over device configurations, application installation permissions, or the ability to block specific app stores on a device.

Identity Protection

Why it fails: Microsoft Entra ID Protection is a tool designed to detect, investigate, and remediate identity-based risks in an organization. It focuses on identifying compromised identities, suspicious sign-ins, and risky users, then applying automated responses like requiring MFA or blocking access. While crucial for security, Identity Protection operates at the identity layer and does not possess capabilities to directly manage or enforce device-level application installation policies or block access to app stores.

Group objects

Why it fails: Group objects in Microsoft Entra ID serve as containers for managing access to resources efficiently. While they can contain user and service principal identities, the group itself is not an identity that authenticates or is assigned permissions directly. Instead, groups facilitate role-based access control (RBAC) by allowing permissions to be assigned to a collection of identities rather than individually, streamlining administration.

Policy objects

Why it fails: Policy objects define rules and configurations that govern behavior, compliance, or security within an environment, such as Azure Policy or Conditional Access policies. These objects are declarative statements or sets of conditions and actions, not entities that can authenticate or be assigned permissions. Therefore, policy objects are mechanisms for enforcing governance and control, not a type of identity that logs in.

Privileged Identity Management

Why it fails: Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within an organization. It focuses on providing just-in-time and just-enough access for privileged roles, reducing the risk associated with standing administrative access. While PIM enhances security by limiting the duration and scope of elevated permissions, it does not directly provide functionality to block user sign-ins based on their geographic location or IP address.

Self-service password reset

Why it fails: Self-service password reset (SSPR) in Microsoft Entra ID allows users to reset their forgotten or expired passwords without requiring administrator assistance. This feature significantly reduces help desk calls and improves user productivity by empowering individuals to regain access to their accounts independently. However, SSPR is solely focused on password management and account recovery, and it lacks any capabilities to enforce access policies or block sign-ins based on network location or other contextual attributes.

Conditional Access policy with a location condition

Why it fails: A Microsoft Entra Conditional Access policy with a location condition is precisely designed to control access based on where a user is signing in from. Administrators can define named locations, which are specific IP address ranges or countries, and then configure policies to block access for users attempting to sign in from those designated locations. This powerful capability allows organizations to enforce granular access controls, preventing unauthorized access from untrusted geographic regions or network segments.

Certificate-based authentication

Why it fails: While Certificate-based authentication (CBA) replaces traditional passwords with digital certificates for identity verification, it is not typically classified as a truly passwordless method in the user experience sense. The initial provisioning of the certificate often requires a password or another form of strong authentication, and the private key protecting the certificate on the device may still be secured by a PIN or password, meaning a secret is still involved in the user's interaction.

SMS-based verification

Why it fails: SMS-based verification, while a common multi-factor authentication (MFA) method, is not considered passwordless because it typically serves as a second factor that supplements a primary password-based login. It sends a one-time passcode (OTP) to a registered phone number, requiring the user to still provide their password for initial authentication before the SMS code is requested. Therefore, it does not eliminate the need for a password.

Time-based one-time password (TOTP)

Why it fails: Time-based one-time password (TOTP) applications generate temporary, rotating codes based on a shared secret key and the current time, commonly used as a second factor in multi-factor authentication. Similar to SMS verification, TOTP is an additional layer of security that typically requires a user to first enter their primary password. It does not replace the password for initial authentication, thus it is not a passwordless method.

User3 must approve the activation request

Why it fails: User3 is a Security Reader and cannot approve role activations.

User1 must approve the activation request

Why it fails: User1 is not necessarily an approver; approval is based on PIM configuration.

User2 must pass MFA

Why it fails: MFA may be required but is not the only prerequisite.

Microsoft Defender for Cloud Apps

Why it fails: Incorrect. Microsoft Defender for Cloud Apps provides visibility and control over cloud app usage but does not enforce Conditional Access policies.

Microsoft Entra Conditional Access

Why it fails: Incorrect. Microsoft Entra Conditional Access is the policy definition engine, not the enforcement component.

Microsoft Intune

Why it fails: Incorrect. Microsoft Intune manages device compliance but relies on Microsoft Entra ID for enforcement.

Mobile device management

Why it fails: Mobile device management (MDM) is a core capability of Microsoft Intune, a separate service within Microsoft Endpoint Manager, not Microsoft Entra External ID. Intune focuses on securing and managing mobile devices, such as smartphones and tablets, by enforcing policies, deploying applications, and ensuring device compliance. While Microsoft Entra ID provides the identity foundation for Intune, External ID itself does not directly offer device management functionalities for corporate or personal devices.

On-premises server monitoring

Why it fails: On-premises server monitoring is primarily handled by services like Azure Monitor and Log Analytics, which collect, analyze, and act on telemetry data from various sources, including on-premises servers. Microsoft Entra External ID is an identity and access management solution focused on external user identities, not infrastructure monitoring or operational health of servers. Its scope is entirely distinct from the tools designed for performance, security, and availability monitoring of physical or virtual server infrastructure.

Identity risk detection

Why it fails: Identity risk detection is a specialized capability provided by Microsoft Entra ID Protection, which is an advanced feature set within Microsoft Entra ID, not directly by External ID. Microsoft Entra ID Protection continuously monitors for suspicious activities, such as anomalous sign-ins, leaked credentials, or impossible travel scenarios, to identify and remediate identity-based risks. While External ID manages external identities, the sophisticated risk analysis and automated remediation are handled by Identity Protection.

The users have not registered for MFA

Why it fails: If users had not registered for Multi-Factor Authentication (MFA), they would typically be blocked from accessing resources protected by a Conditional Access policy that requires MFA, rather than simply being prompted to perform it. When a user attempts to sign in and MFA is required but no registration exists, the system usually directs them to complete the MFA registration process or denies access outright, indicating they cannot satisfy the authentication requirement. A "prompt" implies the user has registered and is being asked to provide a second factor.

The users are not assigned to the policy but are in a nested group

Why it fails: Conditional Access policies are designed to evaluate group memberships, including users who are part of nested groups, to determine policy applicability. Therefore, if the users are indeed part of a nested group that is targeted by the policy, the policy would apply to them. However, this option is incorrect because the issue isn't whether the policy applies, but why MFA is being prompted. If the policy is correctly applied but the location is trusted, MFA would not be required, making this explanation insufficient for the observed prompt.

The Conditional Access policy has session controls enabled

Why it fails: Session controls in Conditional Access policies are applied after a user has successfully authenticated and satisfied any Multi-Factor Authentication requirements. These controls dictate actions or behaviors within an established session, such as restricting downloads, enforcing read-only access, or setting session lifetime limits. They do not, however, trigger the initial Multi-Factor Authentication prompt itself, which occurs during the primary authentication flow to verify identity before a session is even fully established.

Smart card (physical)

Why it fails: Physical smart cards are not a direct, native authentication method within Microsoft Entra ID for cloud-only identities. While they can be used, it typically requires a hybrid identity setup involving Active Directory Federation Services (AD FS) or a similar federation service, or by leveraging certificate-based authentication (CBA) configured within Entra ID, which relies on certificates issued to the smart card rather than the card itself as a direct method.

SMS-based verification

Why it fails: SMS-based verification, while previously common for multi-factor authentication (MFA), is being deprecated by Microsoft as a primary authentication method due to its inherent vulnerabilities, such as SIM swapping and interception risks. Although it can still function as an MFA option in some legacy configurations, Microsoft strongly recommends more secure methods like authenticator apps or FIDO2 keys for robust identity protection.

Microsoft Entra Identity Protection

Why it fails: Microsoft Entra Identity Protection is designed to detect and remediate identity-based risks, such as compromised credentials, anomalous sign-ins, and vulnerable users. While crucial for security, it focuses on real-time risk detection and automated response to protect identities from compromise by blocking or challenging risky sign-ins. It does not provide the mechanism for requesting, approving, and temporarily activating administrative roles on a just-in-time basis.

Microsoft Entra Conditional Access

Why it fails: Microsoft Entra Conditional Access policies enforce specific controls based on various conditions like user, location, device, or application, determining if and how a user can access a resource. While it can require multi-factor authentication or compliant devices for access, it does not provide a mechanism for requesting and approving temporary, time-bound elevation of administrative roles. Its purpose is policy enforcement for existing access, not privilege management for temporary role activation.

Microsoft Entra Access Reviews

Why it fails: Microsoft Entra Access Reviews are primarily used to periodically review existing access assignments to ensure that users still require the access they have been granted. This process helps maintain the principle of least privilege by identifying and removing stale or unnecessary permissions from standing assignments. However, Access Reviews do not facilitate the temporary activation of privileged roles or manage just-in-time access requests; their focus is on the ongoing validation of static, permanent access, not dynamic privilege elevation.

Microsoft Entra B2B collaboration

Why it fails: Microsoft Entra B2B collaboration enables organizations to invite external users, typically from partner companies or vendors, to access their applications and resources. These guest users sign in using their own corporate credentials or social identities, but B2B is specifically designed for inter-organizational business relationships, not for internal employees to use their personal Microsoft accounts to access their own company's services.

Microsoft Entra device enrollment

Why it fails: Microsoft Entra device enrollment is a feature that registers devices, such as laptops and mobile phones, with Microsoft Entra ID. This process allows for device-based conditional access policies and management through tools like Microsoft Intune. Its function is to manage the security posture and compliance of devices accessing corporate resources, not to facilitate user authentication using personal external identities like Microsoft accounts.

Microsoft Entra hybrid identity

Why it fails: Microsoft Entra hybrid identity solutions, primarily Microsoft Entra Connect, synchronize user accounts and groups from an on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID. This enables users with existing on-premises corporate credentials to seamlessly access both on-premises and cloud-based applications. It specifically focuses on integrating corporate identities from an on-premises directory, not on enabling authentication via personal Microsoft accounts.

Set up federation with social identity providers

Why it fails: Microsoft Entra B2B collaboration primarily focuses on enabling external users from other organizations (e.g., partners, vendors) to access your resources using their existing corporate or Microsoft accounts. While B2B does support federation with other Microsoft Entra ID tenants or SAML/WS-Fed identity providers, direct federation with social identity providers like Google or Facebook for your B2B guest users is not its core purpose. This capability is a primary feature of Microsoft Entra B2C, which is designed for customer-facing applications.

External users authenticate using Google or Facebook accounts

Why it fails: While Microsoft Entra B2B collaboration does support some forms of identity federation, direct authentication for external users primarily using social identity providers like Google or Facebook accounts is not its primary design. B2B focuses on business-to-business scenarios where external users typically sign in with their organizational Microsoft Entra ID accounts, Microsoft accounts, or federated identities. The capability for external users to authenticate directly with social accounts is a core feature of Microsoft Entra B2C, which is tailored for customer-facing applications.

External users are provisioned with on-premises Active Directory accounts

Why it fails: Microsoft Entra B2B collaboration is a cloud-based feature that extends your Microsoft Entra ID directory to include guest users. It does not provision or create accounts directly within your on-premises Active Directory. Guest user accounts created via B2B exist solely in Microsoft Entra ID. While these guest users can access on-premises applications if you have configured Microsoft Entra application proxy, their identity remains cloud-based and is not synchronized back to your on-premises AD environment.

Self-service password reset with on-premises writeback

Why it fails: Self-service password reset (SSPR) with on-premises writeback is a feature that allows users to reset their forgotten passwords and have those changes synchronized back to their on-premises Active Directory environment. This capability significantly reduces helpdesk calls but requires a Microsoft Entra ID P1 license because it involves advanced integration and synchronization services between cloud and on-premises identity stores. The free tier only offers basic cloud-only SSPR, not the hybrid writeback functionality.

Conditional Access

Why it fails: Conditional Access is a powerful security policy engine that allows administrators to enforce specific access requirements based on various conditions, such as user location, device compliance, or sign-in risk. This granular control over resource access, enabling policies like multi-factor authentication for specific apps or blocking access from untrusted locations, is a premium feature. Consequently, Conditional Access policies are exclusively available with a Microsoft Entra ID P1 license or higher, not in the free tier.

User provisioning from cloud HR apps

Why it fails: Microsoft Entra ID Free supports automated user provisioning from cloud-based Human Resources (HR) applications, such as Workday or SuccessFactors, directly into Entra ID. This feature streamlines the onboarding and offboarding processes by automatically creating, updating, and deleting user accounts based on changes in the HR system. While advanced provisioning scenarios might require premium features, the ability to synchronize basic user identities from cloud HR systems is a valuable inclusion in the free tier to automate identity lifecycle management.