MS-100 Case Studies & Practical Application 2 — Questions and Answers
Question 1: Contoso has 5,000 on-premises AD users and wants to sync them to Azure AD while keeping password hash synchronization. Some users report they cannot sign in to Microsoft 365 after the initial sync. What is the most likely cause?
- Azure AD Connect health service is not installed
- UPN suffixes in on-premises AD do not match a verified domain in Azure AD (Correct answer)
- Password writeback is not enabled in Azure AD Connect
- The sync cycle interval is set too high
Correct answer: UPN suffixes in on-premises AD do not match a verified domain in Azure AD
When on-premises UPN suffixes are not verified domains in Azure AD, affected accounts cannot sign in because their UPN cannot be resolved.
Question 2: Fabrikam is migrating from Exchange on-premises to Exchange Online. After migration, users in the Chicago office can send internal emails but cannot reach external recipients. What should you check first?
- MX records for the fabrikam.com domain (Correct answer)
- Azure AD Conditional Access policies
- Exchange Online Protection anti-spam settings
- Autodiscover DNS records
Correct answer: MX records for the fabrikam.com domain
External email delivery depends on correct MX records pointing to Exchange Online; if MX records still point on-premises, outbound mail to external recipients will fail.
Question 3: A company wants to enforce MFA only when users sign in from outside the corporate network. Which Azure AD feature enables this with the least administrative overhead?
- Azure AD Identity Protection risk-based policies
- Conditional Access policy with a named location condition (Correct answer)
- Per-user MFA settings in the Azure portal
- Azure AD Privileged Identity Management
Correct answer: Conditional Access policy with a named location condition
A Conditional Access policy with a named location condition can require MFA only when users authenticate from outside defined trusted IP ranges.
Question 4: Northwind Traders acquires a subsidiary running its own Azure AD tenant. Employees from the subsidiary need read-only access to SharePoint Online sites in the parent tenant without creating new accounts. What should you configure?
- Azure AD B2C external identities
- Azure AD B2B collaboration with guest accounts (Correct answer)
- Azure AD Connect cloud sync between the two tenants
- Cross-tenant synchronization with bidirectional writeback
Correct answer: Azure AD B2B collaboration with guest accounts
Azure AD B2B collaboration allows external users from another tenant to access resources as guests without creating duplicate internal accounts.
Question 5: An organization uses Microsoft 365 and needs to ensure that a former employee's mailbox data is retained for 7 years after departure for compliance reasons. What is the correct approach?
- Enable Litigation Hold on the mailbox before offboarding the user
- Export the mailbox to a PST and store it on a file server
- Convert the mailbox to a shared mailbox and leave it active
- Apply a Microsoft 365 retention policy with a 7-year retain-then-delete action (Correct answer)
Correct answer: Apply a Microsoft 365 retention policy with a 7-year retain-then-delete action
A Microsoft 365 retention policy with a 7-year retain-then-delete action ensures compliant automated retention without manual intervention.
Question 6: A global company needs users in Europe to authenticate to Azure AD without their sign-in data leaving the EU region. Which feature should be configured?
- Azure AD authentication methods policy scoped to European users
- Azure AD data residency using the European Union data boundary (Correct answer)
- Conditional Access policy restricting sign-in locations to EU countries
- Azure AD Pass-through Authentication with agents deployed in EU datacenters
Correct answer: Azure AD data residency using the European Union data boundary
The EU Data Boundary for Microsoft services ensures that customer data, including Azure AD authentication data, is stored and processed within the EU.
Question 7: Woodgrove Bank has enabled Self-Service Password Reset (SSPR) but users report they are still prompted to contact the helpdesk when resetting passwords. What is the most likely configuration issue?
- SSPR scope is set to 'None' instead of 'All' or a specific group (Correct answer)
- MFA is not enabled for the affected users
- Password writeback is disabled in Azure AD Connect
- The SSPR registration campaign has not been triggered
Correct answer: SSPR scope is set to 'None' instead of 'All' or a specific group
If SSPR scope is set to 'None,' no users can use the feature; it must be set to 'Selected' with a group or 'All' to enable self-service resets.
MS-100 Case Studies & Practical Application 2
Contoso has 5,000 on-premises AD users and wants to sync them to Azure AD while keeping password hash synchronization.
Some users report they cannot sign in to Microsoft 365 after the initial sync.
What is the most likely cause?