MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 2 — Questions and Answers
Question 1: An organization wants to enforce MFA only when users sign in from outside the corporate network. Which Conditional Access condition should the administrator configure?
- User risk condition
- Named locations condition (Correct answer)
- Device compliance condition
- Sign-in frequency condition
Correct answer: Named locations condition
Named locations allow you to define trusted IP ranges so Conditional Access policies can target or exclude corporate network traffic.
Question 2: A user reports that they are unable to use the Microsoft Authenticator app for MFA because they lost their phone. Which self-service option allows the user to regain access without admin intervention?
- Temporary Access Pass (Correct answer)
- Password reset portal
- Azure AD Join re-enrollment
- Security defaults toggle
Correct answer: Temporary Access Pass
A Temporary Access Pass is a time-limited passcode issued by an admin or self-service that allows users to sign in and register new authentication methods.
Question 3: Which Entra ID feature continuously evaluates session risk in real time and can revoke access mid-session without requiring reauthentication?
- Continuous Access Evaluation (CAE) (Correct answer)
- Identity Protection risky session policy
- Conditional Access sign-in frequency
- Smart Lockout
Correct answer: Continuous Access Evaluation (CAE)
Continuous Access Evaluation (CAE) allows resource providers to respond immediately to critical events such as account disablement or location changes during an active session.
Question 4: An administrator needs to ensure that only Entra ID-registered devices can access Exchange Online. Which Conditional Access grant control should be applied?
- Require approved client app
- Require device to be marked as compliant
- Require Entra ID joined device (Correct answer)
- Require Hybrid Azure AD joined device
Correct answer: Require Entra ID joined device
The 'Require Entra ID joined device' grant control restricts access to devices that have completed Entra ID (Azure AD) device registration or join.
Question 5: A company is piloting passwordless authentication using FIDO2 security keys. Where in the Microsoft Entra admin center should the administrator enable this authentication method?
- Authentication methods policy (Correct answer)
- Conditional Access policies
- Identity Protection policies
- Security defaults settings
Correct answer: Authentication methods policy
FIDO2 security key support is enabled under Authentication Methods Policy in the Entra ID admin center, allowing granular targeting to specific user groups.
Question 6: Which PowerShell module should an MS-102 administrator use to manage Entra ID authentication policies using Microsoft Graph-based cmdlets?
- MSOnline (MSOL)
- AzureAD (Preview)
- Microsoft.Graph (Correct answer)
- ExchangeOnlineManagement
Correct answer: Microsoft.Graph
The Microsoft.Graph PowerShell SDK is the current recommended module for managing Entra ID resources, replacing the deprecated MSOnline and AzureAD modules.
Question 7: An organization enables Password Hash Synchronization (PHS) alongside Pass-Through Authentication (PTA) in a hybrid environment. What is the primary reason for this dual configuration?
- To reduce latency for cloud-only users
- To provide resilience if PTA agents go offline (Correct answer)
- To support SAML-based federation
- To enable seamless SSO without AD FS
Correct answer: To provide resilience if PTA agents go offline
Configuring PHS as a backup alongside PTA ensures users can still authenticate via cloud password hashes if all on-premises PTA agents become unavailable.
MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 2
An organization wants to enforce MFA only when users sign in from outside the corporate network.
Which Conditional Access condition should the administrator configure?