Practice Test Geeks(MS-102) Microsoft 365 Administrator Expert Practice Test
← All MS-102 Flashcard Decks

Microsoft 365 Administrator Expert Managing Entra ID Authentication Flashcards

7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Microsoft 365 Administrator Expert Managing Entra ID Authentication flashcards as text

  1. An administrator wants to reduce MFA prompts for users working on compliant corporate devices while still enforcing MFA for non-compliant devices. Which Conditional Access configuration achieves this?

    Answer: Configure 'Require MFA' with grant control 'OR Require compliant device'

    Using 'Require MFA OR Require compliant device' allows users on compliant devices to skip MFA while non-compliant devices must complete MFA to gain access.

  2. An Entra ID user is blocked due to high user risk. The administrator wants to allow the user to unblock themselves without admin intervention. What should be configured?

    Answer: Enable SSPR and create a risk-based Conditional Access policy requiring password change

    A user risk Conditional Access policy that requires a secure password change, combined with SSPR, allows high-risk users to remediate their own risk and regain access.

  3. Which Entra ID authentication method supports both single-factor and multi-factor authentication scenarios and uses biometrics stored on the device?

    Answer: Windows Hello for Business

    Windows Hello for Business uses device-bound cryptographic keys and supports PIN or biometric unlock, satisfying MFA requirements (something you have + something you are/know).

  4. A tenant administrator reviews the Entra ID authentication methods activity report and finds many users have not registered for MFA. Which feature can automatically prompt users to register during sign-in without creating Conditional Access policies?

    Answer: Azure AD Identity Protection registration policy

    The Entra ID Identity Protection MFA registration policy can target users and groups to prompt MFA registration during sign-in without requiring manually authored Conditional Access policies.

  5. An administrator configures Entra ID Password Protection to extend the global banned password list with custom terms. Where are these custom banned passwords enforced for hybrid environments?

    Answer: On the on-premises Domain Controllers via the DC agent

    The Entra ID Password Protection DC agent is installed on on-premises Domain Controllers and enforces both the global and custom banned password lists for on-premises password changes.

  6. An organization's Conditional Access policy uses a Sign-in Risk condition set to 'High.' A user with a medium-risk sign-in attempts to access SharePoint Online. What happens?

    Answer: The user is allowed access because medium risk does not meet the policy threshold

    A Conditional Access policy set to trigger on High sign-in risk will not apply to Medium risk sign-ins, allowing the user to access the resource according to other applicable policies.

  7. Which Microsoft Entra feature allows an administrator to define which authentication method combinations are acceptable for specific sensitive applications, independently of the tenant-wide MFA requirement?

    Answer: Authentication Strengths

    Authentication Strengths in Conditional Access allow administrators to specify required authentication method combinations (e.g., phishing-resistant only) on a per-application basis.