Practice Test Geeks(MS-102) Microsoft 365 Administrator Expert Practice Test
← All MS-102 Flashcard Decks

Identity & Access Management Flashcards

7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Identity & Access Management flashcards as text

  1. An organization wants to require MFA only when users sign in from outside the corporate network. Which Conditional Access feature is used to define the corporate network boundary?

    Answer: Trusted locations / Named locations

    Named locations (marked as trusted) in Conditional Access define IP ranges for the corporate network, enabling location-based policy conditions.

  2. What is the default behavior when a Conditional Access policy has no exclusions and targets 'All users' — does it apply to the Global Administrator account?

    Answer: Yes, the policy applies to Global Administrators unless explicitly excluded

    Conditional Access policies apply to all users including Global Administrators unless the admin account is explicitly added to exclusions.

  3. A Microsoft 365 administrator wants to enforce that users can only access Exchange Online from Outlook mobile apps with app protection policies applied. Which Conditional Access grant control achieves this?

    Answer: Require approved client app + Require app protection policy

    Combining 'Require approved client app' and 'Require app protection policy' controls enforces that only Intune-managed apps with protection policies can access Exchange Online.

  4. Which Azure AD feature can detect when a user's credentials appear in a known data breach and automatically trigger a risk event?

    Answer: Azure AD Identity Protection — leaked credentials detection

    Azure AD Identity Protection's leaked credentials detection compares user credentials against lists of breached credentials from dark web sources.

  5. An administrator needs to configure Self-Service Password Reset (SSPR) to require users to verify identity using two methods. Which setting controls the number of required authentication methods?

    Answer: Authentication methods > Number of methods required to reset

    In Azure AD SSPR settings, 'Number of methods required to reset' controls how many authentication methods a user must verify before resetting their password.

  6. A company uses Azure AD B2B collaboration. When an external user accepts an invitation and signs in, where is their guest account created?

    Answer: In the inviting organization's Azure AD tenant as a guest user object

    When a B2B invitation is accepted, a guest user object is created in the inviting organization's Azure AD tenant while the user authenticates with their home identity.

  7. Which administrative unit feature in Azure AD allows an administrator to scope role assignments to a subset of users or groups?

    Answer: Administrative units

    Administrative units enable scoped administration by allowing role assignments (e.g., Helpdesk Administrator) to apply only to users or groups within that unit.