Microsoft Identity and Access Administrator Dumps Flashcards

Which Azure AD Connect sync rule precedence value takes priority when two rules conflict — a lower number or a higher number?

Answer: Lower number (e.g., 50) takes priority over higher numbers

In Azure AD Connect, sync rules with a lower precedence number have higher priority and win conflicts over rules with higher numbers.

An administrator needs to audit all changes made to Conditional Access policies in the last 30 days. Where should they look?

Answer: Microsoft Entra audit logs filtered by category 'Policy'

Microsoft Entra audit logs capture all configuration changes, including Conditional Access policy modifications, filterable by the 'Policy' category.

A company acquires another organization and wants to allow the acquired company's Azure AD users to access resources in the parent company's tenant without converting them to guest accounts. Which feature enables this?

Answer: Azure AD cross-tenant synchronization

Cross-tenant synchronization automatically creates and maintains member (non-guest) user objects in the resource tenant synced from the source tenant.

Which Microsoft Entra workload identity feature detects when a service principal or managed identity exhibits anomalous behavior, such as signing in from an unusual location?

Answer: Identity Protection for workload identities

Identity Protection for workload identities extends risk detection to service principals and managed identities, flagging anomalous sign-ins.

An administrator registers an application and needs to ensure it can only be used by users within the organization's tenant. What setting controls this?

Answer: Set 'Supported account types' to 'Accounts in this organizational directory only (Single tenant)'

Setting 'Supported account types' to single-tenant restricts the application so that only accounts in the home tenant can authenticate.

Which SSPR authentication method is considered the most secure because it requires physical possession of a registered device?

Answer: Microsoft Authenticator app notification

The Microsoft Authenticator app push notification requires approval on a registered physical device, providing possession-based verification stronger than SMS or email.

A Conditional Access policy is in 'Report-only' mode. What is the effect on end users signing in?

Answer: Users are not affected; the policy only logs what would have happened

Report-only mode evaluates the policy and logs the result to sign-in logs without enforcing any grant or session controls on the user.