Managing Identity and Access Flashcards

Which Azure AD role has the least privilege to manage Intune device compliance policies?

Answer: Intune Administrator

The Intune Administrator role provides the necessary permissions to manage device compliance policies without granting full Global Administrator access.

A company needs to allow users to join devices to Azure AD without granting them the ability to manage other users. Which setting controls the maximum number of devices a user can Azure AD join?

Answer: Device quota per user in Azure AD

The device quota per user setting in Azure AD > Devices > Device settings controls how many devices each user can Azure AD join.

Which authentication strength setting in Azure AD Conditional Access enforces phishing-resistant MFA methods only?

Answer: Phishing-resistant MFA strength

The Phishing-resistant MFA strength in Conditional Access restricts authentication to methods immune to phishing, such as FIDO2 keys and Windows Hello for Business.

An admin wants to ensure that when a user's risk level is detected as high, their session is blocked. Which Azure AD feature supports this?

Answer: Conditional Access – User risk policy

A Conditional Access user risk policy can be configured to block access when Azure AD Identity Protection detects that a user's risk level is high.

Which protocol does Windows Hello for Business use for authentication in a key trust deployment?

Answer: Kerberos

Windows Hello for Business key trust uses Kerberos for on-premises authentication by leveraging the user's key credential registered in AD.

A conditional access policy is set to require compliant device. A user signs in from an unmanaged personal device. What happens?

Answer: Access is blocked

When a Conditional Access policy requires a compliant device and the device is unmanaged, access is blocked because compliance status cannot be verified.