MS-100 Case Studies & Practical Application 5 — Questions and Answers
Question 1: Bellows College is planning to move from AD FS to Azure AD for authentication. They want to maintain seamless SSO for domain-joined devices without requiring ADFS. What should they configure?
- Azure AD Pass-through Authentication with Seamless SSO
- Azure AD Password Hash Sync with Seamless SSO (Correct answer)
- Azure AD Federation with a third-party IdP
- Azure AD Hybrid Join without Seamless SSO
Correct answer: Azure AD Password Hash Sync with Seamless SSO
Password Hash Sync combined with Azure AD Seamless SSO provides transparent authentication for domain-joined devices without requiring ADFS infrastructure.
Question 2: A company's help desk reports that users frequently lock out their accounts by entering the wrong password on their mobile devices after a password change. Which feature would most directly reduce these incidents?
- Azure AD Identity Protection risky sign-in policies
- Azure AD Password Protection with lockout threshold tuning
- Microsoft Authenticator passwordless sign-in (Correct answer)
- Azure AD Conditional Access requiring compliant devices
Correct answer: Microsoft Authenticator passwordless sign-in
Passwordless sign-in with Microsoft Authenticator eliminates password entry entirely on mobile devices, removing the root cause of lockouts from mistyped passwords.
Question 3: Fourth Coffee needs to ensure that when a Microsoft 365 group is deleted, its associated SharePoint site, mailbox, and Teams workspace are retained for 30 days before permanent deletion. What governs this behavior?
- Microsoft Purview retention policies applied to groups
- The Microsoft 365 Groups soft-delete and restore window (30-day default) (Correct answer)
- SharePoint site recycle bin second-stage retention
- Exchange Online deleted item retention policy
Correct answer: The Microsoft 365 Groups soft-delete and restore window (30-day default)
Microsoft 365 Groups have a built-in 30-day soft-delete period during which the group and all associated workloads can be restored before permanent deletion.
Question 4: An enterprise runs both Exchange Online and Exchange on-premises in a hybrid config. Users report that when they open a shared mailbox located on-premises from Outlook connected to Exchange Online, they receive an error. What is the most likely missing configuration?
- Autodiscover SRV records are missing from public DNS
- The hybrid configuration does not include OAuth (Modern Authentication) between Exchange Online and on-premises (Correct answer)
- The shared mailbox does not have an Exchange Online license
- The Exchange on-premises mailbox database is in a DAG that is not replicated
Correct answer: The hybrid configuration does not include OAuth (Modern Authentication) between Exchange Online and on-premises
Cross-premises mailbox access in hybrid Exchange requires OAuth Modern Authentication to be configured; without it, Outlook cannot authenticate to the on-premises endpoint from Exchange Online.
Question 5: A company wants to track all changes made to Azure AD role assignments over the past 90 days for a compliance audit. Where should the auditor look?
- Azure AD Sign-in logs in the Azure portal
- Azure AD Audit logs filtered by the 'RoleManagement' category (Correct answer)
- Microsoft Defender for Cloud Apps activity log
- Microsoft 365 Unified Audit Log filtered by Exchange workload
Correct answer: Azure AD Audit logs filtered by the 'RoleManagement' category
Azure AD Audit logs with the RoleManagement category record all role assignment additions and removals, and can be exported for 90-day compliance review.
Question 6: Trey Research wants to deploy Microsoft 365 to 10,000 users in phases, starting with IT, then HR, then Sales. They need to assign licenses automatically based on group membership. What is the correct approach?
- Assign licenses individually using the Microsoft 365 admin center user wizard
- Use Group-based licensing in Azure AD to assign Microsoft 365 licenses to departmental security groups (Correct answer)
- Create a PowerShell script that runs nightly to assign licenses to new users
- Use Microsoft Intune compliance policies to trigger license assignment
Correct answer: Use Group-based licensing in Azure AD to assign Microsoft 365 licenses to departmental security groups
Azure AD Group-based licensing automatically assigns or removes licenses as users join or leave the assigned groups, making phased rollout scalable and automated.
Question 7: A company implements a Conditional Access policy requiring Intune-compliant devices for all cloud apps. A contractor using a personal Mac reports being blocked from accessing Outlook Web App. What is the correct solution that grants access while maintaining security?
- Exclude the contractor's account from the Conditional Access policy entirely
- Create a separate Conditional Access policy for unmanaged devices that requires an approved app and app protection policy (MAM-based access) (Correct answer)
- Add the contractor's personal device to Azure AD as an Azure AD registered device
- Lower the Conditional Access policy from 'compliant device' to 'domain-joined device' requirement
Correct answer: Create a separate Conditional Access policy for unmanaged devices that requires an approved app and app protection policy (MAM-based access)
MAM-based Conditional Access (requiring an approved app with app protection policy) extends secure access to unmanaged personal devices without enrolling them in Intune.
MS-100 Case Studies & Practical Application 5
Bellows College is planning to move from AD FS to Azure AD for authentication.
They want to maintain seamless SSO for domain-joined devices without requiring ADFS.
What should they configure?