Manage Identity & Access (Entra ID)

You need to require all members of the Helpdesk group to use multi-factor authentication only when they sign in from outside the corporate network. Which Microsoft Entra ID feature should you use?

• AA password protection policy
• BSecurity defaults
• CConditional Access policy with a named location condition✓
• DPer-user MFA settings for every account

Answer: Conditional Access lets you scope MFA to specific conditions such as a named location, so MFA is enforced only when users sign in from outside trusted IP ranges. Security defaults apply MFA broadly and cannot be scoped by location.

A Global Administrator wants to grant a user the ability to elevate to the User Administrator role only when needed, with approval and a time limit. Which Microsoft Entra ID capability provides this?

• AAdministrative units, narrowing a role assignment to certain users or groups but leaving that assignment standing permanently
• BAccess reviews, run periodically so a reviewer confirms access that already exists rather than granting a role on demand
• CPrivileged Identity Management (PIM)✓
• DEntitlement management

Answer: Privileged Identity Management provides just-in-time, time-bound, and approval-based activation of privileged roles, reducing standing access. Access reviews and entitlement management address recertification and package-based access, not on-demand role elevation.

You want an Azure VM to authenticate to Azure Key Vault to retrieve a secret without storing any credentials in code or configuration. What should you configure?

• AA system-assigned managed identity for the VM✓
• BAn app registration with a certificate uploaded to the VM
• CA service principal with a client secret stored in the VM
• DA shared access signature for the Key Vault

Answer: A system-assigned managed identity gives the VM an identity in Microsoft Entra ID whose credentials are managed by Azure, so no secrets are stored in code or config. Key Vault access is then granted to that identity.

Which Microsoft Entra ID feature lets you recertify group memberships on a recurring schedule so that stale access is removed?

• AIdentity Protection
• BConditional Access
• CContinuous access evaluation
• DAccess reviews✓

Answer: Access reviews let reviewers periodically attest to whether users still need their group memberships or access, automatically removing access that is no longer approved. The other features address sign-in risk and policy enforcement.

You must block legacy authentication protocols such as POP and IMAP for all users because they cannot enforce MFA. What is the recommended approach in Microsoft Entra ID?

• ADisable the accounts that use those protocols
• BEnable a password protection custom banned list
• CCreate a Conditional Access policy that blocks legacy authentication clients✓
• DConfigure a sign-in risk policy set to a high threshold

Answer: A Conditional Access policy can target the legacy authentication clients condition and block them, closing a common bypass of MFA. Risk policies and password protection do not selectively block legacy auth protocols.

A user account in Microsoft Entra ID is flagged because the same account signed in from two distant locations within a short period. Which feature detected this risk?

• AMicrosoft Entra ID Protection✓
• BAzure Policy
• CMicrosoft Defender for Cloud Apps proxy
• DMicrosoft Purview

Answer: Microsoft Entra ID Protection detects risk events such as atypical or impossible travel and surfaces them as user or sign-in risk. It can feed Conditional Access risk-based policies.

You need to grant an external partner access to specific applications for a 90-day project, with self-service requests and automatic expiry. Which Microsoft Entra ID feature is most appropriate?

• APer-user MFA enforcement
• BSeamless single sign-on to silently sign domain-joined users in to apps they have already been assigned
• CAdministrative units that limit the directory objects an admin may manage rather than issuing project access
• DEntitlement management access packages✓

Answer: Entitlement management access packages bundle resources with policies for who can request them, approval workflows, and time-limited assignments, which suits governed external collaboration. Administrative units only scope administrative permissions.

You want to delegate management of a specific set of users and groups in one department to a regional admin without giving them tenant-wide rights. What should you create?

• AA separate Microsoft Entra tenant
• BAn administrative unit scoped to that department✓
• CA resource group
• DA management group

Answer: Administrative units let you scope directory roles to a subset of users, groups, or devices, so a regional admin manages only that department. Management groups and resource groups apply to Azure resources, not directory objects.

You want users to reset their own passwords from the sign-in screen without contacting the helpdesk, with security questions and a mobile code as verification. Which Microsoft Entra ID feature should you enable?

• ASelf-service password reset✓
• BPass-through authentication
• CPassword protection
• DSmart lockout

Answer: Self-service password reset lets users securely reset or unlock their own accounts using registered authentication methods, reducing helpdesk load. Password protection and smart lockout strengthen passwords and block guessing but do not provide user-driven reset.

You must ensure that device compliance, as reported by Microsoft Intune, is required before a user can access a sensitive web application. Which control enforces this?

• AAn access review on the application, recertifying who is assigned but not checking the device at sign-in
• BSecurity defaults, switching on a baseline of MFA for everyone
• CA Conditional Access policy requiring a compliant device✓
• DA password protection policy that blocks weak and banned passwords and never evaluates device state

Answer: A Conditional Access policy can require that the connecting device be marked compliant by Intune as a grant control before allowing access. Security defaults and access reviews cannot evaluate device compliance state at sign-in.

To prevent users from choosing weak or organization-specific banned terms in their passwords across both cloud and on-premises accounts, which capability should you configure?

• AContinuous access evaluation, which lets Microsoft 365 services revoke a session promptly after a critical directory change
• BSmart lockout only
• CConditional Access
• DMicrosoft Entra Password Protection with a custom banned password list✓

Answer: Microsoft Entra Password Protection enforces the global banned list and a custom banned password list, and can be extended on-premises with the domain controller agent. Smart lockout addresses brute force but does not control password content.

You need a single managed identity that can be shared across several Azure Functions so they all access the same Key Vault with one identity. Which type of managed identity should you use?

• AA user-assigned managed identity✓
• BA system-assigned managed identity on each function
• CAn app registration with a client secret
• DA service principal certificate per function

Answer: A user-assigned managed identity is a standalone resource that can be assigned to multiple Azure resources, letting several functions share one identity and one set of Key Vault permissions. System-assigned identities are tied to a single resource each.

During a sign-in, a user's session token should be re-evaluated and revoked promptly if their account is disabled or their risk increases, rather than waiting for token expiry. Which capability provides this near-real-time enforcement?

• APer-user MFA
• BContinuous access evaluation✓
• CSeamless single sign-on
• DSmart lockout

Answer: Continuous access evaluation enables resource providers and Microsoft Entra ID to react to critical events, such as account disablement or elevated risk, by revoking access near real time instead of waiting for the access token to expire. The other options do not perform mid-session revocation.

You want privileged role activations in Microsoft Entra PIM to require a justification and approval, and you want a scheduled attestation that current eligible assignments are still warranted. Which PIM feature performs the periodic attestation?

• AThe maximum activation duration setting, capping how long a single elevation may last
• BAccess reviews for privileged roles✓
• CRole setting notifications that email nominated recipients each time a role is activated
• DJust-in-time activation

Answer: PIM access reviews periodically require reviewers to confirm whether users still need their eligible or active privileged role assignments, removing those that are no longer justified. Activation duration and notifications govern individual activations, not recurring attestation.

You need to give an application a permission to read user profiles from Microsoft Graph that does not require a signed-in user and runs as a background service. Which permission type should you grant and consent to?

• AA Conditional Access exclusion for the application, which alters sign-in conditions rather than granting Graph access
• BAn application permission with admin consent✓
• CA delegated permission consented to by each user, so the app acts on behalf of whoever is signed in
• DA dynamic group membership rule based on attributes

Answer: Application permissions let an app act as itself without a signed-in user, which suits background services, and they require administrator consent. Delegated permissions require a user present in the session.

You want sign-ins assessed as high risk by Microsoft Entra ID Protection to automatically require multi-factor authentication, while low-risk sign-ins are unaffected. What should you configure?

• ASecurity defaults
• BA password protection policy
• CA named location only
• DA sign-in risk-based Conditional Access policy✓

Answer: A sign-in risk-based Conditional Access policy uses the risk level calculated by Microsoft Entra ID Protection to require MFA only when the risk is high, leaving low-risk sign-ins frictionless. Security defaults cannot evaluate risk levels.

You need to require phishing-resistant authentication for administrators accessing the Azure portal, while standard users keep using the Microsoft Authenticator app. Which Conditional Access control best meets the administrator requirement?

• ARequire an authentication strength that mandates FIDO2 or certificate-based authentication✓
• BBlock legacy authentication
• CRequire password change
• DRequire a device that is compliant and enrolled in Microsoft Intune

Answer: Authentication strengths in Conditional Access let you require specific methods; a phishing-resistant strength forces FIDO2 security keys, Windows Hello for Business, or certificate-based authentication for the targeted admins. Requiring a compliant device or blocking legacy auth does not guarantee a phishing-resistant method.

A Conditional Access policy must apply to all users except the break-glass emergency access accounts so that a misconfiguration cannot lock everyone out. How should the break-glass accounts be handled?

• ARegister them for per-user MFA only
• BAdd them to the policy as included users so that the same controls apply to them as to everyone else
• CExclude the emergency access accounts from the policy✓
• DDisable Conditional Access across the tenant so that no policy can ever lock an administrator out

Answer: Emergency access (break-glass) accounts should be excluded from Conditional Access policies, especially MFA and device policies, so a faulty policy or unavailable MFA service cannot lock administrators out of the tenant. They are monitored separately instead.

You want guest users invited through Microsoft Entra B2B to be reviewed every quarter and automatically removed if a reviewer does not approve their continued access. Which feature should you configure?

• AA Conditional Access policy for guests
• BCross-tenant access settings
• CEntitlement management connected organizations, recording which external tenants may request access packages
• DAn access review targeting guest users with auto-apply of results✓

Answer: An access review scoped to guest users can run on a recurring quarterly schedule and be configured so that if reviewers do not approve, or if no decision is made, access is automatically removed. Cross-tenant settings and Conditional Access govern access conditions, not recurring recertification.

Your organisation wants to control which external Microsoft Entra tenants its users can collaborate with and which external apps they can access, centrally. Which feature provides this inbound and outbound control?

• AAdministrative units
• BCross-tenant access settings✓
• CPassword protection
• DSecurity defaults

Answer: Cross-tenant access settings let you configure inbound and outbound B2B collaboration and B2B direct connect on a per-tenant basis, controlling which external organisations and applications your users can work with. Administrative units only scope admin permissions internally.

You need a group whose membership is calculated automatically from a user attribute, such as department equals Finance, so new joiners are added without manual action. Which group type should you create?

• AA Microsoft 365 group whose owners add each new joiner by hand as they arrive
• BA distribution list maintained by the owner
• CA mail-enabled security group, which is synchronised from on-premises and cannot be edited in the cloud
• DA dynamic membership group with a membership rule✓

Answer: A dynamic membership group uses a rule based on user or device attributes, such as department, to populate membership automatically as attributes change. Static groups require manual addition and removal of members.

After enabling a sign-in risk policy, you find legitimate users are repeatedly challenged from a trusted branch office. Without weakening protection elsewhere, how can you reduce these false positives?

• ALower the sign-in risk threshold to low for every user, so that far more sign-ins are challenged everywhere
• BExclude all users from the policy until the false positives stop being reported
• CTurn off Microsoft Entra ID Protection for the tenant so that no risk detections are raised at all
• DMark the branch office public IP range as a trusted named location✓

Answer: Defining the branch office IP range as a trusted named location lowers the risk weighting for sign-ins from that location, reducing false challenges there while keeping risk-based protection in force elsewhere. Disabling protection or excluding all users removes the control entirely.

You want application owners to manage their own app role assignments but not to alter tenant-wide security settings. Which approach follows least privilege?

• AAssign the Application Administrator role tenant-wide
• BAssign ownership of the specific enterprise application✓
• CAdd them to the Security Administrator role
• DGrant them Global Administrator

Answer: Making a user an owner of the specific enterprise application lets them manage that app's users and role assignments without any tenant-wide privilege. Application Administrator and Global Administrator grant far broader rights than the requirement.

A Microsoft Entra Conditional Access policy should enforce a shorter sign-in frequency and prevent persistent browser sessions for users accessing a finance app from unmanaged devices. Which control category provides this?

• ANamed locations
• BGrant controls
• CSession controls✓
• DAuthentication methods

Answer: Session controls in Conditional Access include sign-in frequency and persistent browser session settings, letting you force periodic reauthentication and disable persistent cookies for risky access. Grant controls decide whether access is allowed, not how the session behaves.

You need service principals (workload identities) that authenticate from a specific set of IP ranges only, blocking token requests from anywhere else. Which capability enforces this?

• AA dynamic group whose rule collects the service principals together, affecting membership and not token issuance
• BA Conditional Access policy for workload identities with a location condition✓
• CPer-user MFA
• DSmart lockout

Answer: Conditional Access for workload identities can target service principals and apply a location condition so that tokens are only issued from approved IP ranges, blocking compromised credentials used elsewhere. MFA and smart lockout apply to interactive user sign-ins, not workload identities.

You want to ensure that when a privileged role is activated in PIM, a second approver from a defined list must approve before access is granted. Which PIM role setting controls this?

• ARequire a business justification to be typed in when the role is activated
• BRequire multifactor authentication to be completed at the moment of activation
• CRequire approval to activate with designated approvers✓
• DSet a maximum activation duration

Answer: Configuring the role setting to require approval, and specifying approvers, ensures activation is held pending sign-off from a designated approver before the privileged role becomes active. Justification and MFA settings strengthen activation but do not introduce an approval gate.

A developer accidentally committed a service principal client secret to a public repository. Beyond rotating the secret, which longer-term control eliminates the need for such secrets on Azure-hosted workloads?

• AIncrease the secret expiry to two years
• BEmail the secret to the team
• CStore the secret in app settings
• DUse managed identities for the Azure workloads✓

Answer: Replacing service principal secrets with managed identities removes stored credentials entirely for Azure-hosted workloads, because Azure manages the identity's credentials and rotates them automatically. Extending secret lifetime increases exposure rather than reducing it.

You must allow users to register for self-service password reset but require they register two different authentication methods before they can use it. Where do you configure the number of required methods?

• AIn the Key Vault access policy for the vault's secrets
• BIn the self-service password reset registration settings✓
• CIn a Conditional Access policy, which decides whether a sign-in is allowed rather than how a reset is registered
• DIn the storage account firewall, listing the networks permitted to reach the account

Answer: The self-service password reset configuration includes settings for the number of methods required to reset and whether registration of multiple methods is enforced. Conditional Access governs access decisions, not SSPR method requirements.

To reduce standing Global Administrator assignments, you want most administrators to hold their role as eligible rather than active. What is the security benefit of an eligible assignment in PIM?

• AThe role can never be used
• BIt removes the need for MFA
• CThe administrator must activate the role just in time, limiting the window of standing privilege✓
• DThe role stays permanently active with no expiry, so the administrator never has to request it again before use

Answer: An eligible assignment means the user has no standing access and must activate the role just in time, with the activation bounded by time, approval, and justification, shrinking the window in which privilege exists. Eligible roles are still usable once activated.

Your tenant uses password hash synchronisation. You want sign-in to remain available even if the on-premises identity infrastructure is offline, while still using the same passwords. Which authentication method meets this?

• ACertificate-based authentication only
• BFederation with AD FS
• CPass-through authentication only
• DPassword hash synchronisation✓

Answer: Password hash synchronisation stores a hash of the password hash in Microsoft Entra ID, so authentication can occur in the cloud even when on-premises components are unavailable, while users keep the same password. Pass-through authentication and AD FS depend on on-premises availability.

You want users to be prompted to register security information for MFA and SSPR in a single combined experience the next time they sign in. Which feature should be enabled?

• ASmart lockout
• BA watchlist
• CPer-user MFA legacy portal
• DCombined security information registration✓

Answer: Combined security information registration lets users register authentication methods for both MFA and self-service password reset in one unified flow, simplifying onboarding. The legacy per-user MFA portal handles only MFA registration separately.

An application needs delegated Microsoft Graph permissions, but you want to avoid users individually consenting to risky permissions. Which configuration centralises approval while still allowing low-risk permissions automatically?

• ARemove the application registration from the tenant entirely
• BGrant tenant-wide admin consent to every permission the application requests, so that no user is ever prompted and every scope is live
• CAllow users to consent to any permission an application asks for, leaving the decision with whoever happens to sign in first
• DDisable all user consent and configure an admin consent workflow plus a user consent policy for low-risk permissions✓

Answer: Restricting user consent to a defined set of low-risk permissions and enabling the admin consent workflow lets users request riskier permissions for an administrator to approve, balancing control and usability. Allowing all consent or granting everything removes oversight.

You need to detect and block sign-ins where leaked credentials matching a user's password have been found on the dark web. Which Microsoft Entra ID Protection signal addresses this?

• AA named location marking a range of IP addresses as trusted or untrusted for policy conditions
• BThe impossible travel detection
• CThe unfamiliar sign-in properties detection, comparing a sign-in with the user's usual device and network
• DThe leaked credentials risk detection✓

Answer: Microsoft Entra ID Protection includes a leaked credentials detection that raises user risk when credentials matching the account are found in known breach corpora, which a user risk policy can then act on. Named locations do not detect credential leaks.

You want to allow a specific guest user to be assigned an Azure RBAC role on a resource group, but the invitation must not grant any directory role. Which statement is correct about B2B guests and Azure RBAC?

• AGuests must first become members
• BA B2B guest object can be granted Azure RBAC roles on resources independently of directory roles✓
• CGuests cannot be assigned Azure RBAC roles
• DAssigning Azure RBAC automatically grants the Global Administrator role

Answer: A Microsoft Entra B2B guest is represented by a user object in your directory and can be granted Azure RBAC roles on subscriptions, resource groups, or resources without holding any Microsoft Entra directory role. Azure RBAC and directory roles are separate systems.

To prevent users from being phished into approving fraudulent MFA prompts, you want each push approval to display a number the user must enter from the sign-in screen. Which feature provides this?

• AAn SMS one-time passcode
• BSecurity questions
• CVoice call approval
• DNumber matching in Microsoft Authenticator✓

Answer: Number matching requires the user to type a number shown on the sign-in screen into the Authenticator app, defeating blind approval of fraudulent push notifications. SMS and voice methods are weaker and do not provide the matching challenge.

You need a report of all privileged role activations and assignment changes in PIM for the last 90 days for an audit. Where is this information found?

• AThe Key Vault diagnostic logs, recording every secret and key operation against the vault
• BThe PIM audit history and resource audit logs✓
• CThe storage account metrics, charting transaction volume and capacity for the account
• DThe NSG flow logs for the subnet

Answer: PIM maintains an audit history of activations, assignments, and role setting changes, and these events are also available in the Microsoft Entra audit logs, supporting privileged access auditing. NSG flow logs and storage metrics are unrelated.

A line-of-business app authenticates users but you want to additionally restrict it so only members of a specific group can sign in, enforced at the app level in Microsoft Entra ID. What should you configure?

• AA route table
• BA storage firewall
• CUser assignment required on the enterprise application, with the group assigned✓
• DInfrastructure encryption enabled on the storage account

Answer: Enabling assignment required on the enterprise application and assigning only the permitted group ensures that only assigned users or group members can sign in to the app. Without assignment required, any user in the tenant could access it.

You want to enforce MFA for all users but allow a one-time, time-limited exemption for a contractor who cannot register a method yet, without disabling MFA globally. What is the recommended approach?

• ACreate a temporary exclusion group, add the contractor, and set the group to be removed or reviewed shortly after✓
• BGive the contractor the Global Administrator role, since tenant administrators fall outside the scope of any Conditional Access policy
• CTurn off the MFA policy for every user until the contractor has finished the engagement, then switch it back on afterwards
• DDisable Conditional Access across the whole tenant and rely on the contractor's own device security instead of a policy

Answer: Using a tightly scoped, temporary exclusion group with an access review or planned removal lets you exempt one account briefly without weakening MFA for the rest of the tenant. Disabling the policy globally removes protection for all users.

Which Microsoft Entra capability lets you assign an Azure role to a group so that all current and future members inherit the access, simplifying privileged access management?

• ASmart lockout
• BA named location
• CRole-assignable groups (group-based role assignment)✓
• DAssigning the role to each user individually and repeating the work whenever someone joins the team

Answer: Role-assignable security groups can be granted Microsoft Entra or Azure roles so that membership confers the role, which simplifies management and can be combined with PIM for groups. Assigning roles to each user individually does not scale and is harder to govern.

You suspect a token theft attack where an attacker replays a stolen session token. Which combination of controls most directly reduces the value and lifetime of a stolen token?

• ADisabling MFA
• BLonger token lifetimes together with persistent browser sessions
• CContinuous access evaluation together with token protection (binding the token to the device)✓
• DA storage firewall

Answer: Continuous access evaluation revokes sessions quickly on critical events, and token protection binds the token to the device so a stolen token cannot be replayed elsewhere, together limiting token theft impact. Longer lifetimes and persistence increase exposure.