MS-100 Professional Standards & Competencies 5 — Questions and Answers
Question 1: Which scenario best demonstrates the principle of least privilege in Microsoft 365 administration?
- Granting all IT staff Global Administrator roles for efficiency
- Assigning the Exchange Administrator role only to staff managing email (Correct answer)
- Using a shared admin account to simplify access management
- Giving end users temporary Global Admin access when they need IT help
Correct answer: Assigning the Exchange Administrator role only to staff managing email
Least privilege means assigning only the specific role required for a task, such as Exchange Administrator for email management.
Question 2: A Microsoft 365 admin must document all changes made to tenant configuration for a compliance audit. Which built-in capability supports this requirement?
- Azure AD Named Locations
- Microsoft 365 Unified Audit Log (Correct answer)
- Intune Enrollment Reports
- Microsoft Secure Score history
Correct answer: Microsoft 365 Unified Audit Log
The Unified Audit Log captures all configuration changes and admin activities across Microsoft 365 services for compliance documentation.
Question 3: When planning a Microsoft 365 tenant configuration, which professional standard requires that production changes be tested in a non-production environment first?
- Zero Trust architecture
- Change management process (Correct answer)
- Conditional Access baseline
- Data residency compliance
Correct answer: Change management process
Change management best practices require testing configuration changes in a test or staging tenant before applying them to production.
Question 4: An administrator notices that a user's account has been assigned multiple admin roles redundantly. Which professional practice should be applied?
- Leave the roles assigned for maximum flexibility
- Remove redundant roles to reduce the blast radius of a compromised account (Correct answer)
- Add more roles in case new admin tasks arise
- Convert the account to a Global Administrator to consolidate
Correct answer: Remove redundant roles to reduce the blast radius of a compromised account
Removing unnecessary role assignments reduces the potential damage if the account is compromised, following least-privilege principles.
Question 5: Which Microsoft 365 admin center report helps an administrator identify inactive users who still hold active licenses?
- Secure Score recommendations
- Microsoft 365 Usage reports > User activity (Correct answer)
- Azure AD Sign-in logs > Risky sign-ins
- Message Center > Planned changes
Correct answer: Microsoft 365 Usage reports > User activity
Microsoft 365 Usage reports show per-user activity across services, helping identify inactive users consuming licenses.
Question 6: An organization wants to ensure that when an employee leaves, their Microsoft 365 access is revoked promptly. Which process reflects this professional standard?
- Schedule a weekly review of departed users
- Integrate HR offboarding with Azure AD user lifecycle management (Correct answer)
- Rely on the user to report their own departure
- Disable the account only after the user requests it
Correct answer: Integrate HR offboarding with Azure AD user lifecycle management
Integrating HR offboarding with Azure AD lifecycle management ensures immediate access revocation when an employee departs.
Question 7: Which action should an MS-100 administrator take after completing a significant tenant configuration change during a maintenance window?
- Immediately notify users via email that the change is complete
- Validate the change, document the result, and update the change log (Correct answer)
- Archive the Unified Audit Log entries for the change period
- Revoke all admin sessions to prevent unauthorized changes
Correct answer: Validate the change, document the result, and update the change log
Post-change validation, documentation, and change log updates are essential professional steps to confirm success and maintain records.
MS-100 Professional Standards & Competencies 5
Which scenario best demonstrates the principle of least privilege in Microsoft 365 administration?