MS-102 - Microsoft 365 Administrator Expert Managing Entra ID Authentication Questions and Answers

Question 1

A company is rolling out Self-Service Password Reset (SSPR) for all users. To ensure a smooth rollout, the administrator wants to require users to register their authentication methods upon their next sign-in. Which setting should be configured in the Microsoft Entra admin center?

Accepted Answer

Set 'Require users to register when signing in?' to Yes in the SSPR Registration settings.

Answer

To enforce that users register for SSPR at their next sign-in, the administrator must enable the 'Require users to register when signing in?' option within the Password Reset > Registration settings. This ensures that users who have not yet registered their authentication methods will be prompted to do so before they can proceed.

Question 2

An organization wants to enhance security for its privileged administrator accounts. The goal is to require phishing-resistant multifactor authentication (MFA) whenever an administrator signs in. Which of the following authentication methods would satisfy this requirement?

Accepted Answer

FIDO2 security key

Answer

FIDO2 security keys are a form of passwordless, phishing-resistant authentication. Methods like SMS, push notifications, and email OTPs are considered less secure and are vulnerable to phishing attacks. Microsoft recommends phishing-resistant methods like FIDO2, Windows Hello for Business, or certificate-based authentication for the highest level of security.

Question 3

A Microsoft 365 administrator is configuring a Conditional Access policy to respond to risky sign-ins detected by Microsoft Entra ID Protection. The policy should apply when the sign-in risk level is medium or high. What is the most appropriate 'Grant' control to configure for this policy to allow users to self-remediate?

Accepted Answer

Require multifactor authentication

Answer

When configuring a sign-in risk policy, requiring multifactor authentication allows a user to prove their identity and self-remediate the risk. Blocking access would prevent self-remediation, and requiring a compliant or hybrid joined device might not be possible for the user at that moment and doesn't directly address the sign-in risk itself.

Question 4

Your company wants to allow new employees to set up their passwordless authentication methods, such as the Microsoft Authenticator app or a FIDO2 key, without needing to know a password first. Which Entra ID feature is specifically designed to facilitate this initial onboarding process?

Accepted Answer

Temporary Access Pass (TAP)

Answer

A Temporary Access Pass (TAP) is a time-limited passcode that can be given to a user to sign in and register their passwordless authentication methods. This is the primary method for bootstrapping passwordless credentials without needing a permanent password first.

Question 5

An administrator is reviewing the authentication methods policies in Microsoft Entra ID and notices separate legacy policies for MFA and SSPR. What is the recommended approach for managing authentication methods going forward?

Accepted Answer

Migrate the settings from the legacy MFA and SSPR policies to the modern 'Authentication methods' policy.

Answer

Microsoft's recommended approach is to use the modern 'Authentication methods' policy to centrally manage all methods for both MFA and SSPR. There is a migration guide within the Microsoft Entra admin center to help consolidate settings from the legacy policies into the modern, unified policy.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 - Microsoft 365 Administrator Expert Managing Entra ID Authentication Questions and Answers