MS-102 Identity & Access Management 5 — Questions and Answers
Question 1: An organization wants to require MFA only when users sign in from outside the corporate network. Which Conditional Access feature is used to define the corporate network boundary?
- Trusted locations / Named locations (Correct answer)
- Compliant device filter
- IP risk detection threshold
- Network Access Control integration
Correct answer: Trusted locations / Named locations
Named locations (marked as trusted) in Conditional Access define IP ranges for the corporate network, enabling location-based policy conditions.
Question 2: What is the default behavior when a Conditional Access policy has no exclusions and targets 'All users' — does it apply to the Global Administrator account?
- No, Global Administrators are always excluded from Conditional Access
- Yes, the policy applies to Global Administrators unless explicitly excluded (Correct answer)
- Only if the administrator is signing in from outside the tenant
- Only if the policy uses a block control, not grant controls
Correct answer: Yes, the policy applies to Global Administrators unless explicitly excluded
Conditional Access policies apply to all users including Global Administrators unless the admin account is explicitly added to exclusions.
Question 3: A Microsoft 365 administrator wants to enforce that users can only access Exchange Online from Outlook mobile apps with app protection policies applied. Which Conditional Access grant control achieves this?
- Require compliant device
- Require approved client app + Require app protection policy (Correct answer)
- Require Hybrid Azure AD join
- Require MFA
Correct answer: Require approved client app + Require app protection policy
Combining 'Require approved client app' and 'Require app protection policy' controls enforces that only Intune-managed apps with protection policies can access Exchange Online.
Question 4: Which Azure AD feature can detect when a user's credentials appear in a known data breach and automatically trigger a risk event?
- Microsoft Secure Score
- Azure AD Identity Protection — leaked credentials detection (Correct answer)
- Microsoft Defender for Identity
- Azure AD Audit Logs
Correct answer: Azure AD Identity Protection — leaked credentials detection
Azure AD Identity Protection's leaked credentials detection compares user credentials against lists of breached credentials from dark web sources.
Question 5: An administrator needs to configure Self-Service Password Reset (SSPR) to require users to verify identity using two methods. Which setting controls the number of required authentication methods?
- Authentication methods > Number of methods required to reset (Correct answer)
- Password protection > Lockout threshold
- Identity Protection > User risk policy strength
- Conditional Access > Authentication strength
Correct answer: Authentication methods > Number of methods required to reset
In Azure AD SSPR settings, 'Number of methods required to reset' controls how many authentication methods a user must verify before resetting their password.
Question 6: A company uses Azure AD B2B collaboration. When an external user accepts an invitation and signs in, where is their guest account created?
- In the external user's home tenant only
- In the inviting organization's Azure AD tenant as a guest user object (Correct answer)
- In a shared Microsoft-managed tenant
- In both tenants simultaneously
Correct answer: In the inviting organization's Azure AD tenant as a guest user object
When a B2B invitation is accepted, a guest user object is created in the inviting organization's Azure AD tenant while the user authenticates with their home identity.
Question 7: Which administrative unit feature in Azure AD allows an administrator to scope role assignments to a subset of users or groups?
- Management groups
- Administrative units (Correct answer)
- Resource groups
- Organizational units
Correct answer: Administrative units
Administrative units enable scoped administration by allowing role assignments (e.g., Helpdesk Administrator) to apply only to users or groups within that unit.
