MS-102 Microsoft 365 Administrator Expert Configuring Identity Synchronization 5 — Questions and Answers
Question 1: An administrator discovers that a user's on-premises AD account has been synchronized but the user cannot sign in to Microsoft 365. The account shows 'DirSyncEnabled: True' in Azure AD but no license is assigned. What is the most likely cause?
- The UPN suffix is not verified in Azure AD (Correct answer)
- The user's OU is excluded from synchronization
- Password hash synchronization is not enabled
- The account is in staging mode
Correct answer: The UPN suffix is not verified in Azure AD
If the on-premises UPN suffix doesn't match a verified domain in Azure AD, the user's sign-in name will use the .onmicrosoft.com fallback and they may be unable to authenticate properly.
Question 2: Which PowerShell command is used to check the current status of the Azure AD Connect synchronization scheduler?
- Get-ADSyncScheduler (Correct answer)
- Get-MsolDirSyncProvisioningError
- Get-ADSyncConnectorRunStatus
- Get-ADSyncSyncCycle
Correct answer: Get-ADSyncScheduler
Get-ADSyncScheduler returns the current configuration and status of the Azure AD Connect sync scheduler, including whether it is enabled and the next scheduled run time.
Question 3: A company wants to implement Azure AD Connect cloud sync instead of Azure AD Connect. Which on-premises requirement is eliminated with cloud sync?
- An on-premises Active Directory Domain Services environment
- A server running the provisioning agent
- A network connection to Azure AD
- An on-premises SQL Server for the sync database (Correct answer)
Correct answer: An on-premises SQL Server for the sync database
Azure AD Connect cloud sync uses a lightweight provisioning agent and does not require a local SQL Server, unlike the full Azure AD Connect which uses SQL Server Express or a full SQL instance.
Question 4: Which attribute conflict resolution behavior does Azure AD use when two on-premises objects have the same ProxyAddresses value during synchronization?
- Both objects are quarantined in Azure AD
- The conflicting attribute is randomized for one object
- The duplicate attribute is removed from the newer object and an error is generated (Correct answer)
- Azure AD merges the two objects automatically
Correct answer: The duplicate attribute is removed from the newer object and an error is generated
Azure AD uses the Duplicate Attribute Resiliency feature to quarantine the conflicting attribute, removing it from the newer object and generating a DuplicateAttributeValueMailed error.
Question 5: An administrator wants to verify that password hash synchronization is working correctly. Which PowerShell command provides detailed PHS status?
- Get-MsolDirSyncProvisioningError -ErrorCategory PasswordSyncError
- Get-ADSyncAADPasswordSyncConfiguration -SourceConnector (Correct answer)
- Invoke-ADSyncRunProfile -ConnectorName -RunProfileName
- Get-MsolPasswordSyncStatus
Correct answer: Get-ADSyncAADPasswordSyncConfiguration -SourceConnector
Get-ADSyncAADPasswordSyncConfiguration -SourceConnector returns the password hash synchronization configuration and status for the specified connector.
Question 6: What is the maximum number of Azure AD Connect servers that can actively export to a single Azure AD tenant in a supported configuration?
- 1 (Correct answer)
- 2
- 5
- 10
Correct answer: 1
Only one Azure AD Connect server can actively export to a single Azure AD tenant; additional servers must be in staging mode to avoid conflicts.
Question 7: A hybrid identity administrator must configure soft-match to link an existing cloud-only user account with a newly synchronized on-premises account. Which attribute is used for soft-matching by default?
- objectGUID
- immutableId
- SMTP proxy address or UPN (Correct answer)
- sAMAccountName
Correct answer: SMTP proxy address or UPN
Azure AD uses the SMTP proxy address (primary email) or UPN to soft-match a cloud-only object with an incoming synchronized object when no hard match exists.
MS-102 Microsoft 365 Administrator Expert Configuring Identity Synchronization 5
An administrator discovers that a user's on-premises AD account has been synchronized but the user cannot sign in to Microsoft 365.
The account shows 'DirSyncEnabled: True' in Azure AD but no license is assigned.
What is the most likely cause?