MS-102 Identity & Access Management 3

Question 1

An organization wants to delegate the ability to reset passwords for Help Desk users without granting them Global Administrator rights. Which built-in role is best suited?

Accepted Answer

Helpdesk Administrator

Answer

The Helpdesk Administrator role can reset passwords for non-administrators and manage service requests.

Question 2

Which Azure AD feature provides a time-limited, approval-based workflow for activating privileged roles?

Accepted Answer

Privileged Identity Management (PIM)

Answer

PIM allows eligible users to activate privileged roles for a limited time with optional approval and justification requirements.

Question 3

A user reports they cannot activate their PIM-eligible Global Administrator role. The activation requires MFA, but the user skipped MFA registration. What should the administrator do first?

Accepted Answer

Require the user to complete MFA registration in My Security Info

Answer

The user must first register MFA methods at My Security Info before they can satisfy the MFA requirement during PIM role activation.

Question 4

What type of Azure AD group is required to use Microsoft 365 features like Teams, SharePoint sites, and shared mailboxes?

Accepted Answer

Microsoft 365 group

Answer

Microsoft 365 groups (formerly Office 365 groups) provide shared workspaces including Teams, SharePoint, and shared mailboxes.

Question 5

An administrator needs to enforce that external guest users complete MFA before accessing SharePoint Online. Which is the correct approach?

Accepted Answer

Create a Conditional Access policy targeting guest/external users requiring MFA

Answer

Conditional Access policies can target guest and external users specifically, enforcing MFA as a grant control for SharePoint access.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Identity & Access Management 3