HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory forest named contoso.com. The forest contains the following domains:Contoso.com East.contoso.comThe forest contains the users shown in the following table.The forest syncs to a Microsoft Entra tenant named contoso.com as shown in the exhibit. (Click the Exhibit tab.)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: YesThe UPN of user1 is user1@contoso.com so he can authenticate to Microsoft Entra ID by using the username user1@contoso.com.Box 2: NoThe UPN of user2 is user2@east.contoso.com so he cannot authenticate to Microsoft Entra ID by using the username user2@contoso.com.Box 3: NoThe UPN of user3 is user3@fabrikam.com so he cannot authenticate to Microsoft Entra ID by using the username user3@contoso.com.
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory domain. The domain contains the servers shown in the following table.You purchase a Microsoft 365 E5 subscription.You need to implement Microsoft Entra Connect cloud sync.What should you install first and on which server? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: The Microsoft Entra Connect provisioning agent Install the Microsoft Entra Connect provisioning agentHow is Microsoft Entra Connect cloud sync different from Microsoft Entra Connect sync?With Microsoft Entra Connect cloud sync, provisioning from AD to Microsoft Entra is orchestrated in Microsoft Online Services. An organization only needs to deploy, in their on-premises or IaaS-hosted environment, a light-weight agent that acts as a bridge between Microsoft Entra and AD. The provisioning configuration is stored in Microsoft Entra and managed as part of the service.Box 2: Server1 or Server2 only.Cloud provisioning agent requirements include:* An on-premises server for the provisioning agent with Windows 2016 or later.This server should be a tier 0 server based on the Active Directory administrative tier model. Installing the agent on a domain controller is supported.Note: Windows Server Core is a minimal installation option for the Windows Server operating system (OS) that has no GUI and only includes the components required to perform server roles and run applications.
https://docs.microsoft.com/en-us/azure/active-directory/cloud-sync/how-to-install https://docs.microsoft.com/en-us/azure/active-directory/cloud-sync/how-to-prerequisites
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1 and the users shown in the following table.The devices are configured as shown in the following table.You have a Conditional Access policy named CAPolicy1 that has the following settings:AssignmentsUsers or workload identities: Group1Cloud apps or actions: Office 365 SharePoint Online Conditions- Filter for devices: Exclude filtered devices from the policyRule syntax: device.displayName -startsWith "Device"Access controls Grant- Grant: Block access Session: 0 controls selected3. Enable policy: OnFor each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: NoUser1 is member of Group1 and has Device1. Device1 is not Microsoft Entra joined.Note: Requiring a Microsoft Entra hybrid joined device is dependent on your devices already being Microsoft Entra hybrid joined.Box 2: YesUser2 is member of Group1 and has devices Device2 and Device3. Device2 is Microsoft Entra joined.Device2 is excluded from CAPolicy1 (which would block access to Site1). Box 3: YesUser2 is member of Group1 and has devices Device2 and Device3. Device3 is Android and is Microsoft Entra registered.Device3 is excluded from CAPolicy1 (which would block access to Site1).Note: On Windows 7, iOS, Android, macOS, and some third-party web browsers, Microsoft Entra ID identifies the device using a client certificate that is provisioned when the device is registered with Microsoft Entra ID. When a user first signs in through the browser the user is prompted to select the certificate. The end user must select this certificate before they can continue to use the browser.
https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-hybrid-azure-ad-join https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy- compliant-device
You have a Microsoft 365 E5 subscription.Conditional Access is configured to block high-risk sign-ins for all users.All users are in France and are registered for multi-factor authentication (MFA). Users in the media department will travel to various countries during the next month.You need to ensure that if the media department users are blocked from signing in while traveling, the users can remediate the issue without administrator intervention.What should you configure?
Answer(s): D
Self-remediation with self-service password resetIf a user has registered for self-service password reset (SSPR), then they can also remediate their own user risk by performing a self-service password reset.
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-remediate- unblock
You have a Microsoft 365 E5 subscription that contains the following user:Name: User1UPN: user1@contoso.comEmail address: user1@marketmg.contoso.com MFA enrollment status: DisabledWhen User1 attempts to sign in to Outlook on the web by using the user1@marketing.contoso.com email address, the user cannot sign in.You need to ensure that User1 can sign in to Outlook on the web by using user1@marketing.contoso.com. What should you do?
Microsoft’s recommended best practices are to match UPN to primary SMTP address. This article addresses the small percentage of customers that cannot remediate UPN’s to match.Note: A UPN is an Internet-style login name for a user based on the Internet standard RFC 822. The UPN is shorter than a distinguished name and easier to remember. By convention, this should map to the user's email name. The point of the UPN is to consolidate the email and logon namespaces so that the user only needs to remember a single name.Configure the Microsoft Entra multifactor authentication registration policyMicrosoft Entra ID Protection helps you manage the roll-out of Microsoft Entra multifactor authentication (MFA) registration by configuring a Conditional Access policy to require MFA registration no matter what modern authentication app you're signing in to.
https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties#userprincipalname
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.