MS-500 Identity & Access Management

Question 1

Which Azure AD feature enforces multi-factor authentication based on user risk and sign-in risk signals?

Accepted Answer

Identity Protection

Answer

Azure AD Identity Protection uses risk-based signals to automatically enforce MFA or block sign-ins when suspicious activity is detected.

Question 2

A global administrator wants to limit the time a user holds an elevated role. Which Azure AD feature should be used?

Accepted Answer

Privileged Identity Management (PIM)

Answer

PIM provides just-in-time privileged access, allowing administrators to activate roles only when needed for a limited time.

Question 3

Which protocol does Azure AD use by default for modern authentication in Microsoft 365?

Accepted Answer

OAuth 2.0 / OpenID Connect

Answer

Azure AD uses OAuth 2.0 for authorization and OpenID Connect for authentication as its primary modern authentication protocols.

Question 4

An organization needs to ensure users can only access Microsoft 365 from compliant devices. Which feature enforces this?

Accepted Answer

Conditional Access with device compliance policy

Answer

Conditional Access policies can require that devices meet compliance requirements set in Intune before granting access to Microsoft 365 services.

Question 5

What is the purpose of Azure AD Access Reviews?

Accepted Answer

Periodically validate that users still need their group memberships and role assignments

Answer

Azure AD Access Reviews allow administrators or resource owners to periodically review and certify whether users still need access to resources.

MS-500 - Microsoft 365 Security Administration Practice Test