You have a Microsoft Entra tenant configured as shown in the following exhibit.The tenant contains the identities shown in the following table.You purchase a Microsoft Fabric license.To which identities can you assign the license?
Answer(s): A
You have an Azure subscription that contains a storage account named storage. The storage account contains a blob that stores images.Client access to storage1 is granted by using a shared access signature (SAS).You need to ensure that users receive a warning message when they generate a SAS that exceeds a seven- day time period.What should you do for storage?
Answer(s): D
After you configure the SAS expiration policy, any user who creates a SAS with an interval that exceeds the recommended upper limit will see a warning.Note: How to configure a SAS expiration policyNavigate to your storage account in the Azure portal.2. Under Settings, select Configuration.*-> 3. Locate the setting for Allow recommended upper limit for shared access signature (SAS) expiry interval, and set it to Enabled.Specify the time values under Recommended upper limit for SAS expiry interval for the recommended interval for any new shared access signatures that are created on resources in this storage account.5. Select Save to save your changes.
https://learn.microsoft.com/en-us/azure/storage/common/sas-expiration-policy
You have a Microsoft Entra tenant.You plan to create a group for each department at your company.You need to ensure that user and group permissions meet the following requirements:When a new user is added to the tenant, the user is automatically added to their department’s group. If a user transfers to a different department, their user permissions to department resources must be updated automatically.The solution must minimize administrative effort.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.
Answer(s): D,E
Create a security group that has the Dynamic User membership type.A dynamic user membership type allows users to be automatically added to or removed from the group based on specific criteria, such as department attributes. This ensures that when a new user is added or transferred to a different department, their group membership is updated automatically.Update the user properties.User properties, like department attributes, need to be kept up to date for dynamic groups to work correctly. By ensuring that the user's department field is correctly populated and maintained, the system will automatically place the user in the appropriate department group.
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra tenant that contains a user named User1.You review the licenses assigned to User1 as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: five licensesUser is consuming for Microsoft Intune Suite.For Microsoft Intune Suite we see that 5 out of 8 licenses (Enabled Services) are in use. Box 2: remove User1 from Group1 onlyTo remove Microsoft Fabric (Free) from the license assignments of User1, you must .Assignment Paths for Microsoft Fabric (Free) is: Direct, Inherited (Group1). We must remove User1 from Group1.
https://learn.microsoft.com/en-us/entra/identity/users/licensing-groups-resolve-problems
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft Entra tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group. Solution: On Dev, you assign the Contributor role to the Developers group.Does this meet the goal?
Answer(s): B
Correct:On Dev, you assign the Logic App Contributor role to the Developers group.The Logic App Contributor role lets you manage logic app, but not access to them. It provides access to view, edit, and update a logic app.Incorrect:On Dev, you assign the Contributor role to the Developers group. Contributor role:Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries.* On Subscription1, you assign the DevTest Labs User role to the Developers group.DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your Azure DevTest Labs.
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra tenant that contains the users shown in the following table.You need to perform the following tasks: Create an attribute named Property1.Ensure that Admin1 can assign Property1 to User1.Which two settings should you configure on the Microsoft Entra ID blade? To answer, select the appropriate settings in the answer area.NOTE: Each correct answer is worth one point.Hot Area:03CDC095F9FEFF732D90886CB388BC30
03CDC095F9FEFF732D90886CB388BC3003CDC095F9FEFF732D90886CB388BC30Box 1: Custom security attributes Create an attribute named Property1.Add or deactivate custom security attribute definitions in Microsoft Entra ID Add an attribute set1. Sign in to the Microsoft Entra admin center as an Attribute Definition Administrator.*-> 2. Browse to Protection > Custom security attributes.3. Select Add attribute set to add a new attribute set.4. Etc.Box 2: Roles and administratorsEnsure that Admin1 can assign Property1 to User1.Assign rolesTo grant access to the appropriate people, follow these steps to assign one of the custom security attribute roles.Assign roles at attribute set scopeSign in to the Microsoft Entra admin center as a Attribute Assignment Administrator.Browse to Protection > Custom security attributes.3. Select the attribute set you want grant access to.*-> 4. Select Roles and administrators5. Add assignments for the custom security attribute roles.
https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-add https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-manage
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains a resource group named RG1.You need to prevent administrators from inadvertently modifying the resources in RG1.How should you complete the PowerShell command? To answer, select the options in the answer area.NOTE: Each correct answer is worth one point.Hot Area:
Box 1: New-AzResourceLockLock your resources to protect your infrastructureAs an administrator, you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications. The lock overrides any user permissions.Use Azure PowerShell to lock deployed resources with the New-AzResourceLock command. To lock a resource, provide the resource's name, resource type, and resource group name.New-AzResourceLock -LockLevel CanNotDelete -LockName LockSite -ResourceName examplesite - ResourceType MicrBox 2: ReadOnlyYou can set locks that prevent either deletions or modifications. In the portal, these locks are called Delete and Read-only. In the command line, these locks are called CanNotDelete and ReadOnly.CanNotDelete means authorized users can read and modify a resource, but they can't delete it.ReadOnly means authorized users can read a resource, but they can't delete or update it. Applying this lock is similar to restricting all authorized users to the permissions that the Reader role provides.
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra tenant that contains the users shown in the following table.The tenant contains the groups shown in the following table.Self-service password reset (SSPR) needs to be configured for the tenant.Which users can configure SSPR, and for which group can SSPR be enabled? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Admin1 and Admin2 only UsersAdmin1 - YesAdmin1 is Global AdministratorAdmin2 - YesAdmin2 is Authentication Policy AdministratorNote: Enable self-service password reset Prerequisites include:An account with at least the Authentication Policy Administrator role.Admin3 -NoAdmin3 is Authentication Administrator and Security Administrator. Note: Authentication AdministratorThis is a privileged role. Assign the Authentication Administrator role to users who need to do the following: Set or reset any authentication method (including passwords) for non-administrators and some roles.Require users who are non-administrators or assigned to some roles to re-register against existing non- password credentials (for example, MFA or FIDO), and can also revoke remember MFA on the device, which prompts for MFA on the next sign-in.Manage MFA settings in the legacy MFA management portal.Perform sensitive actions for some users. For more information, see Who can perform sensitive actions. Create and manage support tickets in Azure and the Microsoft 365 admin center.Box 2: Group1 only GroupYou can select a group of users to enable for SSPR.Group1 - YesGroup1 is a Security Group with Assigned membership.Note:Security: Used to manage user and computer access to shared resources. Membership types:Assigned groups: Lets you add specific users as members of a group and have unique permissions.Dynamic membership group for users: Lets you use rules for users to automatically add and remove users as members. If a member's attributes change, the system looks at your rules for dynamic membership groups for the directory. The system checks to see whether the member meets the rule requirements (is added), or no longer meets the rules requirements (is removed).Group2 - NoGroup2 is a Microsoft 365 Group with Dynamic membership.Note: Microsoft 365: Provides collaboration opportunities by giving group members access to a shared mailbox, calendar, files, SharePoint sites, and more.This option also lets you give people outside of your organization access to the group. Members of a Microsoft 365 group can only include users.Group3 - NoGroup3 is a Mail-enabled security Group with Assigned membership.Note:Distribution lists and mail-enabled security groups are managed only in Exchange admin center or Microsoft 365 admin center.
https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference https://learn.microsoft.com/en-us/entra/fundamentals/concept-learn-about-groups
Post your Comments and Discuss Microsoft AZ-104 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-104 content, but please register or login to continue.