Free Microsoft Identity and Access Administrator v1.0 Questions and Answers — Questions and Answers
Question 1: There is a user named User1 in your Azure Active Directory (Azure AD) tenant. You must make sure User1 can add resources to the catalogs they possess and build new ones. <br> What ought you to do?
- From the Roles and administrators blade, modify the Service support administrator role
- From the Roles and administrators blade, modify the Groups administrator role
- From the Identity Governance blade, modify the roles and administrators for the General catalog
- From the Identity Governance blade, modify the Entitlement management settings (Correct answer)
Correct answer: From the Identity Governance blade, modify the Entitlement management settings
‥ Create and oversee a resource catalog using Azure AD entitlement management <br> ‥ Create a catalog <br> A catalog is a collection of materials and access options. You construct a roster when you wish to bundle similar resources and access packages. A user who has been given the ability to create catalogs can do so for resources they own. The first owner of the record is whoever made it. More users, user groups, or application service principals may be added as catalog owners by a catalog owner. Global administrator, Identity Governance administrator, User administrator, or Catalog creator are prerequisite jobs.
Question 2: An Azure Active Directory (Azure AD) tenant and an on-premises Active Directory domain are both present in your network. Users log in to Windows 10 PCs that are joined to the domain. You want to use Seamless Single Sign-On with Azure AD (Azure AD Seamless SSO). The Windows 10 computers must be set up to enable Azure AD Seamless SSO.
- Enable Enterprise State Roaming.
- Configure Sign-in options from the Settings app. (Correct answer)
- Install the Azure AD Connect Authentication Agent.
- Modify the Local intranet Zone settings.
Correct answer: Configure Sign-in options from the Settings app.
‥ Enable Seamless SSO through Azure AD Connect <br> ‥ At the User sign-in page, select the Enable single sign-on option.
Question 3: The users listed in the following table are part of an Azure Active Directory (Azure AD) tenant that belongs to you. <br> <br> You have an administrative unit named Au1. Group1, User2, and User3 are members of Au1. <br> <br> For which users can User5 reset passwords?
- User3 and User4 only
- User2 and User3 only (Correct answer)
- User1, User2, and User3
- User1 and User2 only
Correct answer: User2 and User3 only
User5's password-reset role is scoped to the administrative unit Au1, so they can only reset passwords for members of Au1—User2 and User3 (Group1 is a group, not a user). Users outside Au1, such as User1 and User4, are not within the delegated scope, ruling out the other options.
Question 4: You have a user named User1 in your Azure AD tenant. User1 needs to manage license assignments and reset user passwords. <br> Which role should you assign to User1?
- User administrator (Correct answer)
- Helpdesk administrator
- Billing administrator
- License administrator
Correct answer: User administrator
The User administrator role can manage user properties, reset passwords, and assign licenses for non-admin users, covering both of User1's needs. Helpdesk administrator can reset passwords but not manage licenses, License administrator can assign licenses but not reset passwords, and Billing administrator does neither—so only User administrator covers both tasks.
Question 5: Microsoft Office 365 Enterprise E3 licenses are given to 2,500 users. Individual users are given the licenses. You can provide all users in a group the Microsoft Office 365 Enterprise E5 licenses from the Groups blade in the Azure Active Directory admin center. The users' Office 365 Enterprise E3 licenses must be removed with the least amount of administrative work possible. What should you use?
- The Administrative units blade in the Azure Active Directory admin center (Correct answer)
- The Set-MsolUserLicense cmdlet
- The Set-AzureADGroup cmdlet
- The Set-WindowsProductKey cmdlet
Correct answer: The Administrative units blade in the Azure Active Directory admin center
Administrative units let you logically group users and resources so you can apply changes—including license removal—in bulk rather than touching each of the 2,500 accounts individually, which is the least-administrative-effort path here. The Set-MsolUserLicense and Set-AzureADGroup cmdlets require scripting against each user or only manage group properties, and Set-WindowsProductKey has nothing to do with cloud licensing.
Question 6: Microsoft Office 365 Enterprise E3 licenses are given to 2,500 users. Individual users are given the licenses. You can give all of the users' licenses for Microsoft 365 Enterprise E5 from the Groups blade in the Azure Active Directory admin center. The users' Office 365 Enterprise E3 licenses must be removed with the least amount of administrative work possible. What should you use?
- The Set-MsolUserLicense cmdlet
- The Set-AzureADGroup cmdlet
- The Identity Governance blade in the Azure Active Directory admin center (Correct answer)
- The Set-WindowsProductKey cmdlet
Correct answer: The Identity Governance blade in the Azure Active Directory admin center
The Identity Governance blade centralizes lifecycle and access management—including assigning and removing licenses across large user populations—so the E3 licenses can be stripped with minimal manual effort. The PowerShell cmdlets either require per-user scripting (Set-MsolUserLicense), only edit group attributes (Set-AzureADGroup), or are unrelated to licensing entirely (Set-WindowsProductKey).
Question 7: You have an Azure AD tenant that is synced with your Active Directory forest. <br> You learn that for up to 30 minutes after an Active Directory user account is disabled, the disabled user can still authenticate to Azure AD. <br> When a user account is disabled in Active Directory, you must make sure that it is instantly barred from logging in to Azure AD. <br> <br> Solution: You configure conditional access policies. <br> Does this meet the goal?
- Yes
- No (Correct answer)
Correct answer: No
No. Conditional Access only evaluates conditions at sign-in time and cannot shrink the synchronization delay between on-premises AD and Azure AD, so a disabled account can still authenticate during that gap. To block disabled accounts immediately you need to address the sync itself (for example, forcing a delta sync or using a script), not Conditional Access.
Free Microsoft Identity and Access Administrator v1.0 Questions and Answers
There is a user named User1 in your Azure Active Directory (Azure AD) tenant.
You must make sure User1 can add resources to the catalogs they possess and build new ones.
What ought you to do?