MS-102 - Microsoft 365 Administrator Expert Managing Entra ID Authentication Questions and Answers — Questions and Answers
Question 1: A company is rolling out Self-Service Password Reset (SSPR) for all users. To ensure a smooth rollout, the administrator wants to require users to register their authentication methods upon their next sign-in. Which setting should be configured in the Microsoft Entra admin center?
- Set 'Require users to register when signing in?' to Yes in the SSPR Registration settings. (Correct answer)
- Create a Conditional Access policy that requires registration for all users.
- Enable the 'Combined security information registration' feature for all users.
- Configure the 'Authentication methods' policy to require registration for a mobile app.
Correct answer: Set 'Require users to register when signing in?' to Yes in the SSPR Registration settings.
To enforce that users register for SSPR at their next sign-in, the administrator must enable the 'Require users to register when signing in?' option within the Password Reset > Registration settings. This ensures that users who have not yet registered their authentication methods will be prompted to do so before they can proceed.
Question 2: An organization wants to enhance security for its privileged administrator accounts. The goal is to require phishing-resistant multifactor authentication (MFA) whenever an administrator signs in. Which of the following authentication methods would satisfy this requirement?
- SMS message
- Microsoft Authenticator (push notification)
- FIDO2 security key (Correct answer)
- Email OTP
Correct answer: FIDO2 security key
FIDO2 security keys are a form of passwordless, phishing-resistant authentication. Methods like SMS, push notifications, and email OTPs are considered less secure and are vulnerable to phishing attacks. Microsoft recommends phishing-resistant methods like FIDO2, Windows Hello for Business, or certificate-based authentication for the highest level of security.
Question 3: A Microsoft 365 administrator is configuring a Conditional Access policy to respond to risky sign-ins detected by Microsoft Entra ID Protection. The policy should apply when the sign-in risk level is medium or high. What is the most appropriate 'Grant' control to configure for this policy to allow users to self-remediate?
- Block access
- Require device to be marked as compliant
- Require Microsoft Entra hybrid joined device
- Require multifactor authentication (Correct answer)
Correct answer: Require multifactor authentication
When configuring a sign-in risk policy, requiring multifactor authentication allows a user to prove their identity and self-remediate the risk. Blocking access would prevent self-remediation, and requiring a compliant or hybrid joined device might not be possible for the user at that moment and doesn't directly address the sign-in risk itself.
Question 4: Your company wants to allow new employees to set up their passwordless authentication methods, such as the Microsoft Authenticator app or a FIDO2 key, without needing to know a password first. Which Entra ID feature is specifically designed to facilitate this initial onboarding process?
- Self-Service Password Reset (SSPR)
- Conditional Access
- Temporary Access Pass (TAP) (Correct answer)
- Security Defaults
Correct answer: Temporary Access Pass (TAP)
A Temporary Access Pass (TAP) is a time-limited passcode that can be given to a user to sign in and register their passwordless authentication methods. This is the primary method for bootstrapping passwordless credentials without needing a permanent password first.
Question 5: An administrator is reviewing the authentication methods policies in Microsoft Entra ID and notices separate legacy policies for MFA and SSPR. What is the recommended approach for managing authentication methods going forward?
- Keep the MFA and SSPR policies separate for more granular control.
- Migrate the settings from the legacy MFA and SSPR policies to the modern 'Authentication methods' policy. (Correct answer)
- Disable the legacy policies and have users re-register their methods.
- Use PowerShell to synchronize the settings between the legacy and modern policies.
Correct answer: Migrate the settings from the legacy MFA and SSPR policies to the modern 'Authentication methods' policy.
Microsoft's recommended approach is to use the modern 'Authentication methods' policy to centrally manage all methods for both MFA and SSPR. There is a migration guide within the Microsoft Entra admin center to help consolidate settings from the legacy policies into the modern, unified policy.
Question 6: A user reports being unable to sign in. When you review the Entra ID sign-in logs, you see a sign-in attempt was interrupted with the status 'Failure' and the reason 'Conditional Access policy'. Which of the following is the MOST likely cause?
- The user entered an incorrect password.
- The user's account is disabled.
- The sign-in attempt did not satisfy the requirements of a configured Conditional Access policy. (Correct answer)
- The user has not registered for Self-Service Password Reset (SSPR).
Correct answer: The sign-in attempt did not satisfy the requirements of a configured Conditional Access policy.
Conditional Access policies are enforced after the primary authentication (like password entry) is successful. If a sign-in is blocked by a Conditional Access policy, it means the user, device, location, or other condition did not meet the policy's requirements, such as requiring MFA or a compliant device. An incorrect password would result in a different error, and a disabled account would explicitly state that as the reason.
MS-102 - Microsoft 365 Administrator Expert Managing Entra ID Authentication Questions and Answers
A company is rolling out Self-Service Password Reset (SSPR) for all users.
To ensure a smooth rollout, the administrator wants to require users to register their authentication methods upon their next sign-in.
Which setting should be configured in the Microsoft Entra admin center?