MS-102 Identity & Access Management 3 — Questions and Answers
Question 1: An organization wants to delegate the ability to reset passwords for Help Desk users without granting them Global Administrator rights. Which built-in role is best suited?
- Security Administrator
- Authentication Administrator
- Helpdesk Administrator (Correct answer)
- Password Administrator
Correct answer: Helpdesk Administrator
The Helpdesk Administrator role can reset passwords for non-administrators and manage service requests.
Question 2: Which Azure AD feature provides a time-limited, approval-based workflow for activating privileged roles?
- Conditional Access
- Identity Protection
- Privileged Identity Management (PIM) (Correct answer)
- Access Reviews
Correct answer: Privileged Identity Management (PIM)
PIM allows eligible users to activate privileged roles for a limited time with optional approval and justification requirements.
Question 3: A user reports they cannot activate their PIM-eligible Global Administrator role. The activation requires MFA, but the user skipped MFA registration. What should the administrator do first?
- Grant the role as a permanent assignment temporarily
- Require the user to complete MFA registration in My Security Info (Correct answer)
- Remove MFA requirement from the PIM role setting
- Assign a different admin to complete the task
Correct answer: Require the user to complete MFA registration in My Security Info
The user must first register MFA methods at My Security Info before they can satisfy the MFA requirement during PIM role activation.
Question 4: What type of Azure AD group is required to use Microsoft 365 features like Teams, SharePoint sites, and shared mailboxes?
- Security group
- Mail-enabled security group
- Distribution group
- Microsoft 365 group (Correct answer)
Correct answer: Microsoft 365 group
Microsoft 365 groups (formerly Office 365 groups) provide shared workspaces including Teams, SharePoint, and shared mailboxes.
Question 5: An administrator needs to enforce that external guest users complete MFA before accessing SharePoint Online. Which is the correct approach?
- Enable MFA for all users in the tenant settings
- Create a Conditional Access policy targeting guest/external users requiring MFA (Correct answer)
- Configure SharePoint Online to require MFA via site settings
- Enable the baseline protection policy for guests
Correct answer: Create a Conditional Access policy targeting guest/external users requiring MFA
Conditional Access policies can target guest and external users specifically, enforcing MFA as a grant control for SharePoint access.
Question 6: Which report in Azure AD shows users who have been flagged as potentially compromised based on anomalous sign-in activity?
- Sign-ins report
- Risky users report (Correct answer)
- Audit logs
- Usage & insights report
Correct answer: Risky users report
The Risky users report in Azure AD Identity Protection lists users flagged as compromised based on risk detections.
Question 7: An organization has synchronized on-premises Active Directory users to Azure AD using Azure AD Connect. A user's account is disabled in on-premises AD. What happens to the Azure AD account?
- The Azure AD account is immediately deleted
- The Azure AD account remains active until manually disabled
- The Azure AD account is disabled on the next synchronization cycle (Correct answer)
- The Azure AD account is moved to a soft-delete state
Correct answer: The Azure AD account is disabled on the next synchronization cycle
Azure AD Connect synchronizes account state changes, so the Azure AD account will be disabled after the next sync cycle (default every 30 minutes).
