MS-102 Microsoft 365 Administrator Expert Configuring Identity Synchronization 4 — Questions and Answers
Question 1: An administrator wants to configure Azure AD Connect to use an existing service account instead of creating a new one. During which setup step is this configured?
- Express Settings
- Custom installation under 'Service Account' (Correct answer)
- Connect to Azure AD step
- Optional Features page
Correct answer: Custom installation under 'Service Account'
The custom installation path in Azure AD Connect includes a 'Service Account' configuration step where an existing account can be specified.
Question 2: What is the effect of enabling the 'Do not configure' option for the Azure AD sign-in configuration during Azure AD Connect setup?
- Users will not be able to sign in to Azure AD
- Azure AD Connect will skip configuring UPN suffix mapping (Correct answer)
- Synchronization will run in staging mode
- Password writeback will be disabled
Correct answer: Azure AD Connect will skip configuring UPN suffix mapping
Selecting 'Do not configure' skips the UPN suffix mapping step, leaving the sign-in configuration to be handled manually after installation.
Question 3: Which tool within the Azure AD Connect package is used to troubleshoot and view the attributes of objects in the connector space and metaverse?
- Azure AD Connect Health agent
- Synchronization Service Manager (Correct answer)
- MIM Synchronization Service
- ADSyncDiagnostics module
Correct answer: Synchronization Service Manager
The Synchronization Service Manager provides a GUI to inspect connector spaces, metaverse objects, run history, and troubleshoot sync issues.
Question 4: A Microsoft 365 administrator needs to ensure that users in a specific AD security group are excluded from synchronization to Azure AD. What should they configure?
- OU-based filtering to exclude the group's parent OU
- Group-based filtering in Azure AD Connect (Correct answer)
- Attribute-based filtering using extensionAttribute
- A custom synchronization rule with a scoping filter
Correct answer: Group-based filtering in Azure AD Connect
Group-based filtering in Azure AD Connect allows administrators to limit synchronization to members of a specified Active Directory group, effectively excluding all others.
Question 5: What is the purpose of the 'msDS-ConsistencyGuid' attribute in Azure AD Connect?
- It stores the user's immutable ID used as the source anchor (Correct answer)
- It tracks the last synchronization timestamp
- It identifies the domain controller used for authentication
- It stores the tenant ID of the Azure AD directory
Correct answer: It stores the user's immutable ID used as the source anchor
The msDS-ConsistencyGuid attribute is used by Azure AD Connect as the source anchor (immutableId) to provide a stable, administrator-controllable identity anchor.
Question 6: An organization using AD FS for federation wants to add Azure AD Connect Pass-Through Authentication as a fallback. What must they configure?
- Convert the domain from Federated to Managed in Azure AD (Correct answer)
- Enable PTA as an additional sign-in option alongside AD FS
- Install the PTA agent on the AD FS servers
- Configure Azure AD Connect in staging mode with PTA
Correct answer: Convert the domain from Federated to Managed in Azure AD
To switch from AD FS to Pass-Through Authentication, the domain must be converted from Federated to Managed in Azure AD using Azure AD Connect.
Question 7: Which Azure AD Connect Health alert indicates that the synchronization agent has not connected to the service in more than 24 hours?
- Agent disconnected (Correct answer)
- Sync latency exceeded
- Stale object detected
- Password sync heartbeat failure
Correct answer: Agent disconnected
The 'Agent disconnected' alert fires in Azure AD Connect Health when the sync agent has been unable to communicate with the Azure AD Connect Health service for over 24 hours.
MS-102 Microsoft 365 Administrator Expert Configuring Identity Synchronization 4
An administrator wants to configure Azure AD Connect to use an existing service account instead of creating a new one.
During which setup step is this configured?