MS-102 Identity & Access Management 4 — Questions and Answers
Question 1: A Conditional Access policy is set to 'Report-only' mode. What is the effect on users signing in?
- Users are blocked from signing in until the policy is enabled
- Users can sign in normally, but results are logged for evaluation without enforcement (Correct answer)
- Users must satisfy all policy conditions but are not blocked
- The policy is disabled and has no effect
Correct answer: Users can sign in normally, but results are logged for evaluation without enforcement
Report-only mode evaluates the policy and logs what would happen without actually enforcing access controls, enabling impact assessment.
Question 2: An administrator wants to ensure that only licensed users can be assigned the Teams Administrator role. Where is role assignability controlled in Azure AD?
- Azure AD > Roles and administrators > Role settings (Correct answer)
- Microsoft 365 admin center > Billing > Licenses
- Azure AD > Identity Governance > Access packages
- Azure AD > Conditional Access > Assignments
Correct answer: Azure AD > Roles and administrators > Role settings
Role settings in Azure AD Roles and administrators control eligibility, activation requirements, and assignment rules for each role.
Question 3: What is the primary function of Azure AD Access Reviews in the context of privileged roles?
- Automatically assign roles based on user activity
- Periodically verify that users still need their current role assignments (Correct answer)
- Audit sign-in logs for privileged accounts
- Generate compliance reports for external auditors
Correct answer: Periodically verify that users still need their current role assignments
Access Reviews allow administrators or designated reviewers to periodically confirm whether users still require their privileged role assignments.
Question 4: A company needs to integrate a third-party SaaS application with Azure AD for Single Sign-On using SAML. Which Azure AD component is used to configure this?
- Enterprise applications (Correct answer)
- App registrations
- Identity providers
- Authentication methods
Correct answer: Enterprise applications
Enterprise applications in Azure AD is used to add and configure SAML-based SSO for third-party SaaS applications from the gallery or manually.
Question 5: Which Azure AD feature enables users to request access to applications and resources through a self-service portal?
- My Apps portal with self-service app access
- Azure AD Application Proxy
- Entitlement Management access packages (Correct answer)
- PIM role activation
Correct answer: Entitlement Management access packages
Entitlement Management access packages provide a self-service catalog where users can request access to bundles of resources through a portal.
Question 6: An administrator needs to configure Azure AD Connect to filter which OUs are synchronized to Azure AD. Where is this configured?
- Azure AD portal > Azure AD Connect settings
- Azure AD Connect wizard > Domain/OU Filtering (Correct answer)
- On-premises AD > Group Policy
- Azure AD Connect Health > Sync errors
Correct answer: Azure AD Connect wizard > Domain/OU Filtering
The Azure AD Connect configuration wizard's Domain/OU Filtering step lets administrators select which OUs are included in synchronization.
Question 7: A user's account is assigned the Security Reader role in Azure AD. What can this user do?
- Reset passwords for all users in the tenant
- View security-related reports and configurations without making changes (Correct answer)
- Enable or disable Conditional Access policies
- Manage Identity Protection risk policies
Correct answer: View security-related reports and configurations without making changes
The Security Reader role provides read-only access to security features including Identity Protection, Conditional Access, and security reports.
MS-102 Identity & Access Management 4
A Conditional Access policy is set to 'Report-only' mode.
What is the effect on users signing in?