MS Privileged Identity Management, Entra Roles & Identity Protection

Question 1

In Microsoft Entra Privileged Identity Management, what does an eligible role assignment mean?

Accepted Answer

The user must activate the role when needed, optionally with MFA, justification, or approval

Answer

An eligible assignment gives just-in-time access: the user does not have the permissions until they activate the role. Activation can require MFA, a justification, and approval, and it is time-limited.

Question 2

Which license is required to use Microsoft Entra Privileged Identity Management and Identity Protection risk-based policies?

Accepted Answer

Microsoft Entra ID P2

Answer

PIM and Identity Protection require Microsoft Entra ID P2 (or the Microsoft Entra ID Governance add-on for PIM). P1 includes Conditional Access but not risk-based policies.

Question 3

You need to let a regional IT team reset passwords only for users in the Germany office, not the entire tenant. What should you use?

Accepted Answer

An administrative unit with a scoped role assignment

Answer

Administrative units let you scope Entra roles, such as Helpdesk Administrator or User Administrator, to a subset of users, groups, or devices. This delegates administration without granting tenant-wide permissions.

Question 4

What is a best practice for emergency access (break-glass) accounts in Microsoft Entra ID?

Accepted Answer

Make them cloud-only accounts with the Global Administrator role and exclude at least one from Conditional Access policies that could lock out all admins

Answer

Break-glass accounts should be cloud-only with permanent Global Administrator rights, use strong credentials stored securely, and be monitored. At least one should be excluded from Conditional Access policies that might block access during an outage or misconfiguration.

Question 5

You configure a user risk policy in Microsoft Entra Identity Protection. When a user is flagged as high risk, you want them to regain access securely on their own. Which control should the policy require?

Accepted Answer

Require a secure password change

Answer

A user risk policy typically requires a secure password change for high-risk users. This self-remediates credential compromise, and the user must complete MFA first.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS Privileged Identity Management, Entra Roles & Identity Protection