MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 5

Question 1

An administrator wants to reduce MFA prompts for users working on compliant corporate devices while still enforcing MFA for non-compliant devices. Which Conditional Access configuration achieves this?

Accepted Answer

Configure 'Require MFA' with grant control 'OR Require compliant device'

Answer

Using 'Require MFA OR Require compliant device' allows users on compliant devices to skip MFA while non-compliant devices must complete MFA to gain access.

Question 2

An Entra ID user is blocked due to high user risk. The administrator wants to allow the user to unblock themselves without admin intervention. What should be configured?

Accepted Answer

Enable SSPR and create a risk-based Conditional Access policy requiring password change

Answer

A user risk Conditional Access policy that requires a secure password change, combined with SSPR, allows high-risk users to remediate their own risk and regain access.

Question 3

Which Entra ID authentication method supports both single-factor and multi-factor authentication scenarios and uses biometrics stored on the device?

Accepted Answer

Windows Hello for Business

Answer

Windows Hello for Business uses device-bound cryptographic keys and supports PIN or biometric unlock, satisfying MFA requirements (something you have + something you are/know).

Question 4

A tenant administrator reviews the Entra ID authentication methods activity report and finds many users have not registered for MFA. Which feature can automatically prompt users to register during sign-in without creating Conditional Access policies?

Accepted Answer

Azure AD Identity Protection registration policy

Answer

The Entra ID Identity Protection MFA registration policy can target users and groups to prompt MFA registration during sign-in without requiring manually authored Conditional Access policies.

Question 5

An administrator configures Entra ID Password Protection to extend the global banned password list with custom terms. Where are these custom banned passwords enforced for hybrid environments?

Accepted Answer

On the on-premises Domain Controllers via the DC agent

Answer

The Entra ID Password Protection DC agent is installed on on-premises Domain Controllers and enforces both the global and custom banned password lists for on-premises password changes.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 Microsoft 365 Administrator Expert Managing Entra ID Authentication 5