MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 5 — Questions and Answers
Question 1: An administrator wants to reduce MFA prompts for users working on compliant corporate devices while still enforcing MFA for non-compliant devices. Which Conditional Access configuration achieves this?
- Exclude compliant devices from the MFA Conditional Access policy
- Use session control 'Sign-in frequency: Every time' for compliant devices
- Configure 'Require MFA' with grant control 'OR Require compliant device' (Correct answer)
- Enable Security Defaults with device filter exceptions
Correct answer: Configure 'Require MFA' with grant control 'OR Require compliant device'
Using 'Require MFA OR Require compliant device' allows users on compliant devices to skip MFA while non-compliant devices must complete MFA to gain access.
Question 2: An Entra ID user is blocked due to high user risk. The administrator wants to allow the user to unblock themselves without admin intervention. What should be configured?
- Enable SSPR and create a risk-based Conditional Access policy requiring password change (Correct answer)
- Dismiss the risk detection in Identity Protection manually
- Enable Temporary Access Pass for all high-risk users
- Configure the Authentication Administrator role for the user
Correct answer: Enable SSPR and create a risk-based Conditional Access policy requiring password change
A user risk Conditional Access policy that requires a secure password change, combined with SSPR, allows high-risk users to remediate their own risk and regain access.
Question 3: Which Entra ID authentication method supports both single-factor and multi-factor authentication scenarios and uses biometrics stored on the device?
- OATH hardware token
- Windows Hello for Business (Correct answer)
- Voice call OTP
- Email OTP
Correct answer: Windows Hello for Business
Windows Hello for Business uses device-bound cryptographic keys and supports PIN or biometric unlock, satisfying MFA requirements (something you have + something you are/know).
Question 4: A tenant administrator reviews the Entra ID authentication methods activity report and finds many users have not registered for MFA. Which feature can automatically prompt users to register during sign-in without creating Conditional Access policies?
- Security Defaults registration campaign
- Microsoft Managed Conditional Access baseline policies
- Combined security information registration (Interrupt mode)
- Azure AD Identity Protection registration policy (Correct answer)
Correct answer: Azure AD Identity Protection registration policy
The Entra ID Identity Protection MFA registration policy can target users and groups to prompt MFA registration during sign-in without requiring manually authored Conditional Access policies.
Question 5: An administrator configures Entra ID Password Protection to extend the global banned password list with custom terms. Where are these custom banned passwords enforced for hybrid environments?
- Only in Entra ID cloud authentication flows
- On the on-premises Domain Controllers via the DC agent (Correct answer)
- In Exchange Online mailbox policies
- Through Microsoft Defender for Identity only
Correct answer: On the on-premises Domain Controllers via the DC agent
The Entra ID Password Protection DC agent is installed on on-premises Domain Controllers and enforces both the global and custom banned password lists for on-premises password changes.
Question 6: An organization's Conditional Access policy uses a Sign-in Risk condition set to 'High.' A user with a medium-risk sign-in attempts to access SharePoint Online. What happens?
- The user is blocked because any risk triggers the policy
- The user is allowed access because medium risk does not meet the policy threshold (Correct answer)
- The user is prompted for MFA regardless of the policy
- The user's session is terminated by Continuous Access Evaluation
Correct answer: The user is allowed access because medium risk does not meet the policy threshold
A Conditional Access policy set to trigger on High sign-in risk will not apply to Medium risk sign-ins, allowing the user to access the resource according to other applicable policies.
Question 7: Which Microsoft Entra feature allows an administrator to define which authentication method combinations are acceptable for specific sensitive applications, independently of the tenant-wide MFA requirement?
- Authentication Strengths (Correct answer)
- Conditional Access app filter
- Per-app MFA settings in Azure AD Classic
- Privileged Identity Management activation requirements
Correct answer: Authentication Strengths
Authentication Strengths in Conditional Access allow administrators to specify required authentication method combinations (e.g., phishing-resistant only) on a per-application basis.
MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 5
An administrator wants to reduce MFA prompts for users working on compliant corporate devices while still enforcing MFA for non-compliant devices.
Which Conditional Access configuration achieves this?