MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 4 — Questions and Answers
Question 1: A company's Entra ID Connect sync is running in Staging Mode. What is the effect of this configuration?
- Only password hashes are synchronized to Entra ID
- The sync engine imports and exports but does not write changes to Entra ID (Correct answer)
- Users are blocked from signing in until staging is disabled
- Only group objects are synchronized in this mode
Correct answer: The sync engine imports and exports but does not write changes to Entra ID
In Staging Mode, Entra ID Connect runs full sync cycles and populates its local database but does not apply any changes to Entra ID or on-premises AD, making it safe for testing.
Question 2: Which Entra ID role grants the minimum permissions needed to reset user passwords and manage MFA registration for non-admin users?
- Global Administrator
- Authentication Administrator (Correct answer)
- User Administrator
- Privileged Authentication Administrator
Correct answer: Authentication Administrator
The Authentication Administrator role can reset passwords and manage MFA settings for non-privileged users, following the principle of least privilege.
Question 3: An organization needs to ensure that service accounts used by applications cannot sign in interactively and are not required to perform MFA. Which Entra ID object type is best suited for this scenario?
- Guest user account
- Managed Identity (Correct answer)
- Workload Identity with federated credentials
- Service account with MFA exclusion in Conditional Access
Correct answer: Managed Identity
Managed Identities are non-interactive identities managed by Azure that eliminate the need for credentials entirely, making them ideal for service-to-service authentication.
Question 4: A Conditional Access policy is set to 'Report-Only' mode. What is the impact on end users?
- Users are blocked from signing in until the policy is activated
- Users must complete MFA but results are only logged
- Users experience no change in sign-in behavior, but policy outcomes are logged (Correct answer)
- Users receive a warning message during sign-in
Correct answer: Users experience no change in sign-in behavior, but policy outcomes are logged
Report-Only mode evaluates a Conditional Access policy and logs what the outcome would have been without enforcing it, allowing administrators to assess impact before enablement.
Question 5: An administrator needs to configure Entra ID to send sign-in logs to a Log Analytics workspace for long-term retention. Which Azure service should be configured?
- Microsoft Sentinel alert rules
- Diagnostic Settings on the Entra ID tenant (Correct answer)
- Microsoft Defender for Identity sensor
- Azure Monitor action groups
Correct answer: Diagnostic Settings on the Entra ID tenant
Diagnostic Settings in Entra ID allow routing of audit logs, sign-in logs, and other telemetry to a Log Analytics workspace, Event Hub, or Storage Account.
Question 6: Which Entra ID feature prevents users from using recently used passwords when they perform a self-service password reset?
- Password Protection banned password list
- Password History enforcement via on-premises AD policy (Correct answer)
- Smart Lockout threshold settings
- SSPR writeback password complexity rules
Correct answer: Password History enforcement via on-premises AD policy
Password history is enforced through the on-premises Active Directory password policy when password writeback is configured, preventing reuse of recent passwords.
Question 7: A Microsoft 365 tenant has Security Defaults enabled. A user reports they cannot use a third-party mail client that uses Basic authentication. What is the cause?
- The user's license does not include Exchange Online
- Security Defaults blocks all legacy authentication protocols (Correct answer)
- The mail client requires an app registration in Entra ID
- The user's Conditional Access policy blocks mobile apps
Correct answer: Security Defaults blocks all legacy authentication protocols
Security Defaults blocks legacy authentication protocols including Basic Auth, which is used by older mail clients, requiring modern authentication-capable clients instead.
MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 4
A company's Entra ID Connect sync is running in Staging Mode.
What is the effect of this configuration?