Microsoft Identity and Access Administrator Certification Flashcards

A company needs to synchronize on-premises AD groups to Azure AD without deploying Azure AD Connect Sync. Which lightweight alternative should they use?

Answer: Azure AD Connect cloud sync

Azure AD Connect cloud sync uses lightweight provisioning agents and is designed for scenarios where full Azure AD Connect Sync is not needed or desired.

Which Microsoft Entra feature allows administrators to publish on-premises web applications securely to external users without a VPN?

Answer: Microsoft Entra application proxy

Entra Application Proxy publishes on-premises web applications through the cloud so external users access them via Azure AD authentication without a VPN tunnel.

An access review is configured for an Azure AD group. What happens to group members who do not respond to the review and auto-apply is enabled with 'Remove access' as the result?

Answer: They are automatically removed from the group at review completion

When auto-apply is enabled with 'Remove access,' members who are not approved (including non-responses) are automatically removed from the group when the review period ends.

A tenant administrator wants to prevent any user from consenting to third-party applications requesting high-privilege permissions. Which setting enforces this?

Answer: User consent settings set to 'Do not allow user consent' or restricted to verified publishers only

The User consent settings under Enterprise Applications > Consent and Permissions centrally controls whether users can grant consent and to what level of permissions.

Which Azure AD role grants the minimum permissions needed to reset passwords for non-admin users and manage authentication methods for those users?

Answer: Authentication Administrator

The Authentication Administrator role can reset passwords and manage authentication methods for non-privileged users, with more scope than Helpdesk Administrator.

A Conditional Access policy is set to report-only mode. What is the effect on end users?

Answer: Users are not blocked or prompted; policy results are logged for analysis only

Report-only mode evaluates the Conditional Access policy and logs what would have happened without enforcing any block or grant controls on users.

An organization uses SSPR (Self-Service Password Reset). Which report shows which users have registered their authentication methods for SSPR?

Answer: SSPR Registration Activity report in Azure AD > Monitoring > Usage & Insights

The SSPR Registration Activity report under Usage & Insights shows authentication method registration status and trends for users in the tenant.