Manage Identity & Access (Entra ID)

A security engineer must ensure that Global Administrator rights are granted only for the duration of a specific task and require approval each time. Which Microsoft Entra capability meets this requirement?

• AA Conditional Access policy that blocks access outside of core business hours
• BAn access review that recertifies the role assignment on a monthly basis
• CPrivileged Identity Management (PIM) with eligible, time-bound role activation✓
• DAn administrative unit that scopes the role to a subset of directory objects

Answer: PIM provides just-in-time, time-bound activation of privileged roles and can require approval and justification at activation, so standing Global Administrator access is removed. Access reviews recertify existing assignments but do not make them just-in-time; Conditional Access governs sign-in conditions, not role duration.

When a role is configured as 'eligible' rather than 'active' in Privileged Identity Management, what must a user do before they can use the role's permissions?

• AWait for the next scheduled directory synchronization cycle to automatically promote the eligible assignment to an active one
• BRequest a permanent assignment from another administrator holding the same role
• CActivate the role for a limited period, meeting any configured MFA, justification or approval requirements✓
• DSign out and sign back in so that the new permissions are written into a freshly issued access token for the session

Answer: An eligible assignment grants no permissions until the user activates it, at which point PIM enforces the activation controls you set, such as MFA, justification, ticket information or approval. Eligibility is not promoted automatically and does not require a new permanent assignment.

Which Conditional Access control requires the connecting device to be marked compliant by Microsoft Intune before access to a cloud app is granted?

• AA session control that limits the sign-in to an app-enforced restriction
• BA grant control requiring the use of an approved client application only
• CA session control that applies a shorter sign-in frequency to the session
• DA grant control requiring the device to be marked as compliant✓

Answer: The 'Require device to be marked as compliant' grant control checks the Intune compliance state of the device and blocks access when it is not compliant. Approved client app is a separate grant control about which app is used, and sign-in frequency and app-enforced restrictions are session controls, not device-compliance checks.

A Conditional Access policy is created in report-only mode. What is the effect on users who match the policy?

• AThe policy is enforced only for administrators while all other users are exempt
• BThe policy's result is logged for evaluation but its grant and session controls are not enforced✓
• CThe policy immediately blocks the access attempt and records it in the tenant audit logs
• DThe policy applies its controls but allows users to bypass them once per day

Answer: Report-only mode evaluates the policy at sign-in and records what the outcome would have been in the sign-in logs, without actually applying grant or session controls. It lets you assess impact before enforcing, and applies to targeted users generally, not only administrators.

Which authentication method is considered phishing-resistant and passwordless in Microsoft Entra ID?

• ASMS text message one-time passcodes
• BVoice call verification to a registered phone
• CFIDO2 security keys✓
• DSecurity questions configured during registration

Answer: FIDO2 security keys use public-key cryptography bound to the site, so credentials cannot be phished or replayed, and no password is used. SMS, voice and security questions are either not passwordless or are susceptible to interception and social engineering.

An engineer wants users to sign in with their phone using number matching to reduce accidental MFA approvals. Which method should be configured?

• AThird-party OATH hardware tokens issued to each individual user
• BCertificate-based authentication using certificates from an internal CA
• CMicrosoft Authenticator push notifications with number matching enabled✓
• DTemporary Access Pass values generated for one-time onboarding use

Answer: Number matching is a feature of Microsoft Authenticator push notifications that requires the user to type a number shown on the sign-in screen, defeating blind approval of fraudulent prompts. OATH tokens, certificate-based authentication and Temporary Access Pass do not use push approvals.

What is the primary difference between an app registration and an enterprise application (service principal) in Microsoft Entra ID?

• AThe app registration stores user assignments, while the enterprise application stores the application's reply URLs and secrets
• BThe app registration is the global application definition, while the enterprise application is the local instance and identity used within a tenant✓
• CThe app registration is used for multitenant applications, while the enterprise application object is used for single-tenant applications within the directory
• DThe app registration is created automatically at the first sign-in, while the enterprise application is registered manually by an administrator beforehand

Answer: An app registration defines the application globally in its home tenant, and a service principal (represented as an enterprise application) is the local representation that governs sign-in and resource access within a given tenant. Secrets and reply URLs live on the registration, and multitenant behaviour depends on configuration, not this distinction.

Which setting most effectively prevents non-privileged users from consenting to third-party applications that request access to organizational data?

• ADisabling the registration of security information for all users so that no new authentication methods can be added
• BRequiring multifactor authentication on every interactive user sign-in, including apps that request no data at all
• CBlocking legacy authentication protocols with a Conditional Access policy so only modern authentication can connect
• DConfiguring user consent settings to disallow user consent, or to allow it only for verified publishers and low-impact permissions✓

Answer: User consent settings determine whether users can grant applications access to data on their behalf; restricting consent to admins, or to verified publishers with low-impact permissions, stops risky OAuth consent grants. MFA and blocking legacy auth protect sign-in but do not govern application consent.

An admin wants to review and approve application permission requests that users are not allowed to consent to themselves. Which feature should be enabled?

• AThe admin consent workflow✓
• BThe application proxy connector
• CThe self-service password reset flow
• DThe entitlement management catalog

Answer: The admin consent workflow lets users request admin approval for applications they cannot consent to, routing the request to reviewers who grant or deny it. Application proxy publishes on-premises apps, self-service password reset handles credentials, and entitlement management governs access packages.

A developer needs an Azure VM to authenticate to Azure Key Vault without storing any credentials in code. Which identity type should be used?

• AA service account with its password stored in an app setting
• BA user account granted a role assignment on the key vault
• CA shared access signature token embedded in the application
• DA managed identity assigned to the virtual machine✓

Answer: A managed identity gives the Azure resource an identity in Microsoft Entra ID that the platform manages, so the VM obtains tokens with no secret in code or configuration. Storing a service-account password or embedding a SAS token reintroduces the credential-handling risk managed identities remove.

What is the key operational difference between a system-assigned and a user-assigned managed identity?

• AA system-assigned managed identity is used for Azure RBAC roles, while a user-assigned managed identity is used for Microsoft Entra directory roles
• BA system-assigned identity shares the lifecycle of a single resource, while a user-assigned identity is a standalone resource that several resources can share✓
• CA system-assigned identity works across tenants, while a user-assigned identity is limited to a single subscription
• DA system-assigned identity requires a client secret, while a user-assigned identity authenticates with a certificate

Answer: A system-assigned managed identity is created on and deleted with its single parent resource, whereas a user-assigned managed identity is an independent object you can attach to many resources and that survives them. Both use platform-managed credentials and can receive Azure RBAC role assignments.

Which Conditional Access session control lets you monitor and block risky in-session actions such as downloads by routing traffic through Microsoft Defender for Cloud Apps?

• AContinuous access evaluation for near-real-time token revocation
• BToken protection to bind a sign-in session to a specific device
• CAuthentication context to trigger step-up authentication in apps
• DConditional Access App Control (session control)✓

Answer: Conditional Access App Control routes sessions through Defender for Cloud Apps as a reverse proxy, enabling in-session monitoring and controls such as blocking downloads. Continuous access evaluation revokes tokens on events, token protection binds tokens to a device, and authentication context triggers step-up, but none proxies the session.

A Conditional Access policy should force users to reauthenticate every four hours in a sensitive application. Which control achieves this?

• AA sign-in frequency session control set to the required interval✓
• BA persistent browser session control set to never persist cookies
• CA grant control requiring a compliant or Microsoft Entra hybrid-joined device
• DA user risk condition set to require a secure password change after MFA

Answer: The sign-in frequency session control defines how often a user must reauthenticate, so setting it to four hours enforces periodic reauthentication. Persistent browser session controls cookie persistence, device controls check device state, and user-risk conditions respond to detected risk rather than a fixed interval.

Which Microsoft Entra ID Protection detection would classify a sign-in as risky because it originates from an IP address associated with anonymized network traffic?

• AThe leaked credentials user risk detection
• BThe anonymous IP address sign-in risk detection✓
• CThe password spray offline risk detection
• DThe impossible travel activity risk detection

Answer: The anonymous IP address detection flags sign-ins coming from anonymizing services such as anonymous VPNs or the Tor network. Leaked credentials is a user-risk detection based on found credential pairs, and impossible travel and password spray are separate detections based on different signals.

You must grant a helpdesk team the ability to reset passwords for users in one department only, not the whole directory. What should you use?

• AA custom Azure RBAC role scoped to the department's resource group
• BA role assignment scoped to an administrative unit containing that department's users✓
• CA Conditional Access policy that specifically targets the department's own dedicated user group
• DA dynamic membership rule that automatically adds the helpdesk team to the department's group

Answer: Administrative units scope Microsoft Entra role permissions to a subset of directory objects, so a Password Administrator assigned over an administrative unit can manage only those users. Azure RBAC governs Azure resources rather than directory user management, and Conditional Access and dynamic rules do not delegate administrative permissions.

What does enabling continuous access evaluation (CAE) provide for supported Microsoft Entra workloads?

• AAutomatic rotation of the application's client secrets shortly before they are due to expire
• BOffline caching of access tokens so apps keep working without network access
• CConsolidation of multiple sign-in logs into a single unified audit stream
• DNear-real-time enforcement of critical events, such as revoking access shortly after an account is disabled✓

Answer: Continuous access evaluation lets resource providers and Microsoft Entra ID exchange events so that changes like a disabled account, password reset or elevated risk are enforced quickly, rather than waiting for a token to expire. It does not rotate secrets, cache tokens offline or merge logs.

Which approach lets an application obtain a token to call Microsoft Graph as itself, with no signed-in user present?

• AThe client credentials flow using application permissions granted with admin consent✓
• BThe authorization code flow that uses delegated permissions granted interactively by the signed-in user
• CThe device code flow using delegated permissions on an input-constrained device
• DThe on-behalf-of flow, which exchanges an incoming user token for a downstream service token

Answer: The client credentials flow authenticates the application itself using application permissions, which require admin consent, and is used for daemon or background scenarios with no user. The other flows all involve a user context and delegated permissions.

To reduce standing access, an engineer converts permanent role assignments to eligible ones and requires approval to activate. Which PIM feature records who approved each activation for later audit?

• AThe Conditional Access sign-in log for the activated session
• BThe Microsoft Entra provisioning log for the role change
• CThe PIM audit history for role activations and approvals✓
• DThe Azure Activity log for the subscription's control plane

Answer: PIM maintains its own audit history of eligibility changes, activations, approvals and denials, which is the authoritative record for privileged-access governance. Sign-in logs, provisioning logs and the Azure Activity log capture other signals but not the PIM approval chain.

A Temporary Access Pass (TAP) is most appropriate in which scenario?

• AProviding a permanent backup sign-in method for shared kiosk devices
• BGranting an external partner standing access to a single application
• COnboarding a new user or bootstrapping a passwordless method when the user has no other credential yet✓
• DReplacing the need for Conditional Access entirely for users who travel abroad

Answer: A Temporary Access Pass is a time-limited passcode used to register or recover passwordless methods, ideal for onboarding or when a user has lost their credentials. It is deliberately short-lived, so it is not a permanent method, external-access tool or Conditional Access substitute.

Which condition in a Conditional Access policy evaluates the calculated likelihood that a given sign-in was performed by the account owner?

• AThe user risk condition
• BThe device platform condition
• CThe sign-in risk condition✓
• DThe client apps condition

Answer: Sign-in risk represents the probability that a specific authentication request was not made by the legitimate owner, and it can trigger controls such as requiring MFA. User risk reflects the probability the account itself is compromised, while device platform and client apps are non-risk conditions.

What is the recommended way to give an Azure Function secure access to a storage account without a connection string in configuration?

• AAssign the function a managed identity and grant it a data-plane RBAC role on the storage account✓
• BStore the storage account access key in the function's application settings
• CGenerate a long-lived shared access signature token and paste it into the function's code
• DUse the storage account's anonymous public read access for the container

Answer: A managed identity plus an Azure RBAC data role, such as Storage Blob Data Contributor, lets the function authenticate with Microsoft Entra ID and no stored secret. Access keys and long-lived SAS tokens are credentials that can leak, and anonymous access removes authentication entirely.

An organization wants guests to lose access automatically if their access is not recertified periodically. Which capability should be configured?

• AConditional Access policies that require MFA for all guest sign-ins to the organization's applications
• BEntitlement management access package catalogs that are shared directly with the external guest tenant
• CCross-tenant access settings that trust the MFA claims from the guest's home tenant
• DAccess reviews that remove access when reviewers do not reconfirm it✓

Answer: Access reviews periodically ask reviewers to confirm continued need, and can be set to remove access automatically for anyone not recertified, which is ideal for guest lifecycle governance. MFA, catalogs and cross-tenant trust control how guests authenticate or are granted access, not recertification.

Which statement about the Global Administrator role is correct from a least-privilege standpoint?

• AIt should be assigned permanently to the security engineering team so that incident response is not delayed by role activation
• BIt should be permanently active on break-glass accounts that are excluded from monitoring
• CIt should be limited to a small number of accounts and made eligible through PIM rather than permanently assigned✓
• DIt should be replaced by a set of custom Azure RBAC role definitions assigned permanently at the subscription scope

Answer: Least privilege calls for very few Global Administrators, activated just-in-time via PIM, with monitored break-glass accounts as a controlled exception. Broad permanent assignment increases risk, break-glass accounts need strong protection and monitoring, and custom Azure RBAC roles govern Azure resources rather than directory-wide administration.

A Conditional Access policy must apply only when users access a specific set of high-value operations inside an application. Which feature lets the app signal that context to Conditional Access?

• ANamed locations, defined by trusted IP ranges and referenced by the policy
• BFilter for devices, using device attributes to include or exclude devices
• CTerms of use, requiring the user to accept a policy document at sign-in
• DAuthentication context, referenced by the application and targeted by the policy✓

Answer: Authentication context lets an application tag sensitive actions so a Conditional Access policy can require step-up controls only for those actions. Named locations, device filters and terms of use are other targeting or grant mechanisms that do not represent in-app operation sensitivity.

Which tool provides a guided way to move your organization toward passwordless authentication by reporting on method registration and usage?

• AThe Microsoft Defender for Cloud secure score recommendations
• BThe authentication methods activity and registration reports in Microsoft Entra✓
• CThe Microsoft Purview data loss prevention analytics reports
• DThe Azure Advisor operational excellence recommendations shown in the portal

Answer: The authentication methods activity reports show which methods users have registered and are using, helping you track passwordless adoption and target campaigns. Defender for Cloud secure score, Purview DLP analytics and Azure Advisor address other posture, data and resource concerns.

What is the effect of enabling security defaults in a Microsoft Entra tenant?

• AA fully customizable set of Conditional Access policies is created automatically for administrators to edit and target at chosen users
• BUsers are exempted from multifactor authentication until an administrator later opts each of them in individually
• CA baseline set of protections is enforced, including MFA registration and blocking legacy authentication, with no granular customization✓
• DAdministrator accounts are protected, while standard user accounts keep using legacy authentication protocols

Answer: Security defaults apply a fixed baseline, such as requiring MFA registration for all users, always requiring it for admins, and blocking legacy authentication, but you cannot tune them. For granular control you disable security defaults and use Conditional Access policies instead.

An application shows a large number of users granting it delegated permissions. Which action best investigates whether this is a consent-based attack?

• AReset the passwords of users who have signed into the tenant recently, then compare the sign-in volumes afterwards
• BReview the OAuth application's permissions and consent grants, and audit sign-in and consent events for that app✓
• CDisable multifactor authentication for the whole tenant temporarily so that sign-in volumes can be compared easily
• DDelete the enterprise application immediately, before examining its permissions, consent grants or sign-in activity

Answer: Illicit consent grant attacks trick users into authorizing a malicious app; investigating means reviewing the app's requested permissions, its consent grants and the related audit and sign-in events before deciding to disable or remove it. Mass password resets, disabling MFA or deleting before investigating destroy evidence or add risk.

Which Microsoft Entra feature lets you bundle applications, groups and roles into a request-and-approval package for time-limited access?

• AEntitlement management access packages✓
• BPrivileged Identity Management role settings
• CConditional Access authentication strengths
• DAdministrative units with delegated management

Answer: Entitlement management lets you define access packages that bundle resources with approval, expiration and review policies, ideal for onboarding and external collaboration. PIM governs privileged role activation, authentication strengths define allowed MFA combinations, and administrative units scope directory administration.

An authentication strength in Conditional Access is used to do what?

• AIncrease the password complexity and minimum length requirement that applies to the cloud-only users targeted by the policy
• BRequire a specific combination of authentication methods, such as phishing-resistant MFA, for the targeted resource✓
• CExtend the lifetime of the refresh tokens that are issued to the trusted client applications used by the targeted users
• DRaise the license tier assigned to each targeted account so that additional premium security features are unlocked

Answer: Authentication strengths let a Conditional Access policy demand particular method combinations, for example only phishing-resistant methods like FIDO2 or certificate-based authentication, for sensitive resources. They do not change password policy, token lifetimes or licensing.

You need to block access to Microsoft 365 from all locations except your corporate network ranges. Which combination should you configure?

• AA named location for the corporate ranges plus a policy that blocks access from all other locations✓
• BA trusted device filter plus a policy that requires a compliant device only
• CAn authentication context plus a policy that requires terms-of-use acceptance
• DA user-risk condition plus a policy that requires the user to perform a secure password change

Answer: Defining the corporate ranges as a named location and then blocking sign-ins from any location except that one enforces network-based restriction. Device filters, authentication context and user-risk conditions address device state, in-app sensitivity and account risk rather than network location.

Which is the most secure way to store and retrieve a client secret that a web app uses to call an API?

• AEmbed the secret in the compiled application binary to keep it off disk
• BReplace the secret with a managed identity, or store it in Azure Key Vault and retrieve it at runtime✓
• CPlace the secret in a public configuration file protected by obscurity
• DEmail the plaintext secret to the operations team so they can paste it into each server

Answer: Eliminating the secret with a managed identity is best; where a secret is unavoidable, Key Vault stores it securely and the app retrieves it at runtime using its identity. Embedding in a binary, placing it in a public file, or emailing it all expose the secret.

What does the 'block legacy authentication' Conditional Access policy protect against?

• AProtocols that cannot enforce MFA, such as older mail clients using basic authentication✓
• BModern browsers that fail to present a device compliance certificate
• CApplications that request particularly high-impact Microsoft Graph API permissions
• DSign-ins from devices that are not enrolled in mobile device management

Answer: Legacy authentication protocols, including older POP, IMAP and SMTP clients using basic authentication, cannot perform MFA and are a common route for password-spray and brute-force attacks, so blocking them closes that gap. The other items concern device state and app permissions, not legacy protocols.

An engineer wants app owners to manage only their own applications' credentials, not all apps. Which is the least-privilege approach?

• AAssign ownership of the specific application objects to the app owners✓
• BGrant the Application Administrator role across the whole directory
• CGrant each of the app owners the Global Administrator role, limited to business hours only
• DAdd the app owners to the Cloud Application Administrator role group for the tenant

Answer: Assigning app ownership on the specific application objects lets owners manage just those apps, which is least privilege. The Application Administrator and Cloud Application Administrator roles grant tenant-wide application management, and Global Administrator is far broader still.

When your organization collaborates with an external Microsoft Entra organization, which capability decides whether the partner's multifactor authentication and device-compliance claims are trusted for inbound and outbound access?

• ASelf-service sign-up user flows configured with custom attribute collection pages
• BPer-application assignment requiring users to be assigned before sign-in
• CGroup-based licensing that assigns licenses through security group membership
• DInbound and outbound cross-tenant access settings with trust settings for MFA and device claims✓

Answer: Cross-tenant access settings govern B2B collaboration, including whether to trust MFA and device compliance claims from a partner tenant for inbound and outbound access. Self-service sign-up, per-app assignment and group-based licensing serve unrelated purposes.

A user reports their account was flagged with high user risk. Which remediation typically clears the risk when configured in a risk-based policy?

• ARequiring the user to re-register their device with mobile device management before signing in again
• BRequiring the user to accept the organization's terms of use again
• CRequiring the user to switch over to a completely different but still supported web browser
• DRequiring a secure password change after successful multifactor authentication✓

Answer: A user-risk policy commonly requires a secure password change, performed after MFA, which remediates the risk and clears the user-risk state when the credentials are believed compromised. Device re-registration, terms-of-use acceptance and changing browser do not remediate credential-based user risk.

What is the purpose of assigning users to an enterprise application and enabling 'assignment required'?

• AOnly users or groups explicitly assigned to the application can sign in to it✓
• BAll users in the tenant can sign in but only assigned users see it on the portal
• CAssigned users bypass Conditional Access policies that target the application
• DThe application automatically provisions accounts for any user who signs in

Answer: With assignment required enabled, only users and groups assigned to the enterprise application can access it, which restricts the audience. It does not exempt anyone from Conditional Access, and it does not auto-provision accounts for unassigned users.

Which Microsoft Entra role can manage Conditional Access policies without holding full Global Administrator rights?

• ASecurity Administrator✓
• BReports Reader
• CHelpdesk Administrator
• DGroups Administrator

Answer: The Security Administrator role can create and manage Conditional Access policies and other security features, providing a least-privilege alternative to Global Administrator for that task. Reports Reader is read-only, and Helpdesk and Groups Administrators manage credentials and groups respectively.

You must ensure that highly privileged admin accounts never sign in from unmanaged devices. Which control is most appropriate?

• AA PIM setting that shortens the maximum activation duration for the roles
• BA Conditional Access policy targeting the admin roles that requires a compliant or hybrid-joined device✓
• CAn access review that recertifies each administrator role assignment at the end of each month
• DAn authentication strength that permits SMS and voice call as second factors

Answer: Targeting the privileged roles with a Conditional Access policy that requires a managed device (compliant or hybrid-joined) blocks admin sign-ins from unmanaged endpoints. Shorter activation, access reviews and a permissive authentication strength do not enforce device management state.

An OAuth permission grant shows an application was granted 'Mail.ReadWrite' as an application permission. What is the security significance?

• AThe app is only ever able to read and write the single consenting user's own mailbox during their signed-in session
• BThe permission has no effect until each user separately consents to the same scope
• CThe app can read and write mail across all mailboxes without a signed-in user, so it warrants close review✓
• DThe permission applies only while an administrator with an activated privileged role is signed in to the tenant

Answer: Application permissions apply tenant-wide with no user context, so Mail.ReadWrite as an application permission means the app can access all mailboxes, which is high impact and should be tightly reviewed. Delegated permissions, by contrast, are scoped to the signed-in user's session.