MS-102 - Microsoft 365 Administrator Expert Configuring Identity Synchronization Questions and Answers — Questions and Answers
Question 1: A company is planning to synchronize its on-premises Active Directory to Microsoft Entra ID. They want to test configuration changes and have a disaster recovery solution. Which Microsoft Entra Connect feature should they use?
- Pass-through Authentication
- Staging mode (Correct answer)
- Seamless Single Sign-On
- Microsoft Entra Connect Health
Correct answer: Staging mode
Staging mode allows an administrator to install a second Microsoft Entra Connect server that reads data from all connected directories but does not write any changes. This is ideal for testing configuration changes and for disaster recovery, as the staging server can be quickly made active if the primary server fails.
Question 2: An administrator needs to prevent a specific set of user accounts, located in a particular Organizational Unit (OU), from synchronizing to Microsoft Entra ID. Which is the recommended method to achieve this using the Microsoft Entra Connect configuration wizard?
- Attribute-based filtering
- Group-based filtering
- Domain and OU filtering (Correct answer)
- Disabling the scheduler
Correct answer: Domain and OU filtering
Domain and OU filtering is a straightforward method available within the Microsoft Entra Connect installation wizard that allows administrators to select specific OUs to include or exclude from synchronization. This directly prevents objects within the deselected OUs from being synchronized.
Question 3: Your organization uses Microsoft Entra Connect with Password Hash Synchronization. You have placed the primary sync server into staging mode to perform maintenance. Which of the following statements is true regarding the server in staging mode?
- The server will continue to export all object changes to Microsoft Entra ID.
- The server stops synchronizing password changes from the on-premises AD. (Correct answer)
- The server's SQL database is deleted to save space.
- The server automatically takes over if the new primary server fails.
Correct answer: The server stops synchronizing password changes from the on-premises AD.
When a Microsoft Entra Connect server is put into staging mode, it ceases to perform exports. This includes stopping the synchronization of password changes and password writeback, even if those features were selected during installation. It continues to import and synchronize data to its own database but does not write to Microsoft Entra ID or on-premises AD.
Question 4: A Microsoft 365 administrator is deploying Microsoft Entra Connect Health for Sync. What is a primary prerequisite for completing the agent installation and successfully registering it with the health service?
- A Microsoft Entra ID P1 or P2 license. (Correct answer)
- The server must be a read-only domain controller (RODC).
- The account used must have only the Hybrid Identity Administrator role.
- The server must be running Windows Server Core.
Correct answer: A Microsoft Entra ID P1 or P2 license.
Using Microsoft Entra Connect Health requires a Microsoft Entra ID P1 or P2 license. The first health agent requires at least one license, and each subsequent agent requires additional licenses. Without the appropriate license, the configuration cannot be completed.
Question 5: Which of the following is a key characteristic of Microsoft Entra Cloud Sync that differentiates it from the traditional Microsoft Entra Connect Sync?
- It requires a full SQL Server installation for its database.
- It uses lightweight, on-premises agents with configuration managed in the cloud. (Correct answer)
- It is the only tool that supports Password Hash Synchronization.
- It cannot synchronize objects from a multi-forest, disconnected AD environment.
Correct answer: It uses lightweight, on-premises agents with configuration managed in the cloud.
Microsoft Entra Cloud Sync uses lightweight provisioning agents installed on-premises, while the main synchronization configuration and engine are managed in the cloud via the Microsoft Entra admin center. This contrasts with Microsoft Entra Connect Sync, which runs the entire sync engine on an on-premises server.
Question 6: An administrator needs to customize an attribute flow for user objects being synchronized to Microsoft Entra ID. To ensure the changes are not overwritten during a future Microsoft Entra Connect upgrade, what is the recommended practice?
- Directly edit the default 'In from AD - User Common' rule.
- Export the default rule, modify it, and re-import it with the same precedence.
- Disable the default rule and create a new custom rule from scratch.
- Clone the default rule, disable the original, and give the new rule a precedence value less than 100. (Correct answer)
Correct answer: Clone the default rule, disable the original, and give the new rule a precedence value less than 100.
The best practice for customizing default synchronization rules is to clone the existing rule, disable the original default rule, and then modify the cloned rule. The new custom rule should be given a high precedence (a lower numeric value, typically between 1-99) to ensure it is processed before other rules. This prevents the custom changes from being overwritten when Microsoft Entra Connect is upgraded.
MS-102 - Microsoft 365 Administrator Expert Configuring Identity Synchronization Questions and Answers
A company is planning to synchronize its on-premises Active Directory to Microsoft Entra ID.
They want to test configuration changes and have a disaster recovery solution.
Which Microsoft Entra Connect feature should they use?