MS-102 Identity & Access Management 2 — Questions and Answers
Question 1: A Microsoft 365 administrator needs to ensure that users can sign in only from devices that are joined to Azure AD. Which Conditional Access condition should be configured?
- Require compliant device
- Require Hybrid Azure AD joined device (Correct answer)
- Require approved client app
- Require app protection policy
Correct answer: Require Hybrid Azure AD joined device
The 'Require Hybrid Azure AD joined device' grant control restricts access to devices that are joined to both on-premises AD and Azure AD.
Question 2: An organization uses Azure AD Password Protection. What happens when a user attempts to set a password containing a term from the global banned password list?
- The password is accepted but flagged for review
- The user receives an error and must choose a different password (Correct answer)
- The password is accepted after MFA verification
- The account is locked until an admin resets it
Correct answer: The user receives an error and must choose a different password
Azure AD Password Protection rejects passwords that match or are variants of terms on the global or custom banned password lists.
Question 3: Which Azure AD feature allows you to automatically assign or remove group memberships based on user attribute values?
- Access packages
- Dynamic groups (Correct answer)
- Privileged Identity Management
- Entitlement management
Correct answer: Dynamic groups
Dynamic groups use membership rules based on user or device attributes to automatically manage group membership.
Question 4: A company wants to prevent users from registering personal devices with Azure AD unless they are in a specific security group. Which setting controls this?
- Device compliance policy
- Device enrollment restrictions
- Users may join devices to Azure AD setting (Correct answer)
- Conditional Access device filter
Correct answer: Users may join devices to Azure AD setting
The 'Users may join devices to Azure AD' setting in Azure AD Device settings controls which users can register or join devices.
Question 5: In Azure AD Entitlement Management, what is an 'access package'?
- A bundle of licenses assigned to a user
- A collection of resources and policies that govern who can request access to those resources (Correct answer)
- A Conditional Access policy set
- A PIM role assignment group
Correct answer: A collection of resources and policies that govern who can request access to those resources
An access package is a bundle of resources (groups, apps, SharePoint sites) with policies defining who can request access and for how long.
Question 6: What is the purpose of Azure AD Identity Protection's 'User risk policy'?
- Block access for all users with no MFA registered
- Automatically require users with risky sign-in behavior to change their password (Correct answer)
- Disable accounts that have been inactive for 90 days
- Enforce device compliance before sign-in
Correct answer: Automatically require users with risky sign-in behavior to change their password
The User risk policy detects compromised accounts and can automatically require a password change when a user's risk level exceeds a threshold.
Question 7: An administrator configures a Conditional Access policy with session control 'Sign-in frequency' set to 4 hours for all cloud apps. What does this enforce?
- Users must re-authenticate every 4 hours when using covered apps (Correct answer)
- MFA is required every 4 hours regardless of persistent session
- Tokens expire server-side after 4 hours
- Accounts are locked after 4 hours of inactivity
Correct answer: Users must re-authenticate every 4 hours when using covered apps
Sign-in frequency session control forces users to reauthenticate after the specified interval when accessing covered applications.
MS-102 Identity & Access Management 2
A Microsoft 365 administrator needs to ensure that users can sign in only from devices that are joined to Azure AD.
Which Conditional Access condition should be configured?