MS-500 Identity & Access Management 1 — Questions and Answers
Question 1: Which Azure AD feature enforces multi-factor authentication based on user risk and sign-in risk signals?
- Conditional Access
- Identity Protection (Correct answer)
- Privileged Identity Management
- Access Reviews
Correct answer: Identity Protection
Azure AD Identity Protection uses risk-based signals to automatically enforce MFA or block sign-ins when suspicious activity is detected.
Question 2: A global administrator wants to limit the time a user holds an elevated role. Which Azure AD feature should be used?
- Conditional Access policies
- Privileged Identity Management (PIM) (Correct answer)
- Identity Protection
- Azure AD roles
Correct answer: Privileged Identity Management (PIM)
PIM provides just-in-time privileged access, allowing administrators to activate roles only when needed for a limited time.
Question 3: Which protocol does Azure AD use by default for modern authentication in Microsoft 365?
- SAML 2.0
- OAuth 2.0 / OpenID Connect (Correct answer)
- Kerberos
- NTLM
Correct answer: OAuth 2.0 / OpenID Connect
Azure AD uses OAuth 2.0 for authorization and OpenID Connect for authentication as its primary modern authentication protocols.
Question 4: An organization needs to ensure users can only access Microsoft 365 from compliant devices. Which feature enforces this?
- Azure AD Identity Protection
- Conditional Access with device compliance policy (Correct answer)
- Microsoft Defender for Identity
- Azure AD Access Reviews
Correct answer: Conditional Access with device compliance policy
Conditional Access policies can require that devices meet compliance requirements set in Intune before granting access to Microsoft 365 services.
Question 5: What is the purpose of Azure AD Access Reviews?
- Monitor sign-in logs for suspicious activity
- Periodically validate that users still need their group memberships and role assignments (Correct answer)
- Block risky sign-ins in real time
- Manage password policies for cloud users
Correct answer: Periodically validate that users still need their group memberships and role assignments
Azure AD Access Reviews allow administrators or resource owners to periodically review and certify whether users still need access to resources.
Question 6: Which Azure AD feature synchronizes on-premises Active Directory identities to Azure AD?
- Azure AD Connect (Correct answer)
- Azure AD B2B
- Azure AD Domain Services
- Azure AD Proxy
Correct answer: Azure AD Connect
Azure AD Connect is the tool used to synchronize on-premises Active Directory users, groups, and attributes to Azure AD.
MS-500 Identity & Access Management 1
Which Azure AD feature enforces multi-factor authentication based on user risk and sign-in risk signals?