Practice Test Geeks(MS-102) Microsoft 365 Administrator Expert Practice Test
← All MS-102 Flashcard Decks

Identity & Access Management Flashcards

7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Identity & Access Management flashcards as text

  1. An organization wants to delegate the ability to reset passwords for Help Desk users without granting them Global Administrator rights. Which built-in role is best suited?

    Answer: Helpdesk Administrator

    The Helpdesk Administrator role can reset passwords for non-administrators and manage service requests.

  2. Which Azure AD feature provides a time-limited, approval-based workflow for activating privileged roles?

    Answer: Privileged Identity Management (PIM)

    PIM allows eligible users to activate privileged roles for a limited time with optional approval and justification requirements.

  3. A user reports they cannot activate their PIM-eligible Global Administrator role. The activation requires MFA, but the user skipped MFA registration. What should the administrator do first?

    Answer: Require the user to complete MFA registration in My Security Info

    The user must first register MFA methods at My Security Info before they can satisfy the MFA requirement during PIM role activation.

  4. What type of Azure AD group is required to use Microsoft 365 features like Teams, SharePoint sites, and shared mailboxes?

    Answer: Microsoft 365 group

    Microsoft 365 groups (formerly Office 365 groups) provide shared workspaces including Teams, SharePoint, and shared mailboxes.

  5. An administrator needs to enforce that external guest users complete MFA before accessing SharePoint Online. Which is the correct approach?

    Answer: Create a Conditional Access policy targeting guest/external users requiring MFA

    Conditional Access policies can target guest and external users specifically, enforcing MFA as a grant control for SharePoint access.

  6. Which report in Azure AD shows users who have been flagged as potentially compromised based on anomalous sign-in activity?

    Answer: Risky users report

    The Risky users report in Azure AD Identity Protection lists users flagged as compromised based on risk detections.

  7. An organization has synchronized on-premises Active Directory users to Azure AD using Azure AD Connect. A user's account is disabled in on-premises AD. What happens to the Azure AD account?

    Answer: The Azure AD account is disabled on the next synchronization cycle

    Azure AD Connect synchronizes account state changes, so the Azure AD account will be disabled after the next sync cycle (default every 30 minutes).