HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription.From Microsoft Entra Privileged Identity Management (PIM), you configure Role settings for the Global Administrator role as shown in the following exhibit.You make a user named admin1@contoso.com eligible for the Global Administrator role.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: justification and Azure Multi-Factor Authentication (MFA) In the exhibit we see:Activation:Require justification on activation: Yes On activation, require Azure MFA: YesBox 2: Azure Multi-Factor Authentication (MFA) and assignment duration In the exhibit we see:Assignment:Allow permanent eligible assignment: No Expire eligible assignment after: 15 day(s)Require Azure Multi-Factor Authentication on active assignment: Yes
https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
You have a Microsoft 365 subscription that contains more than 2,000 guest users.You need to ensure that when guest users are added to Microsoft 365 groups, their membership is validated by the group owner every 30 days.What should you configure?
Answer(s): C
Access reviews in Microsoft Entra ID enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed regularly to make sure only the right people have continued access.When should you use access reviews?* Too many users in privileged roles: It's a good idea to check how many users have administrative access, how many of them are Global Administrators, and if there are any invited guests or partners that haven't been removed after being assigned to do an administrative task.* When automation is not possible: You can create rules for dynamic membership on security groups or Microsoft 365 Groups, but what if the HR data isn't in Microsoft Entra ID or if users still need access after leaving the group to train their replacement? You can then create a review on that group to ensure those who still need access should have continued access.* Etc.
https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 subscription that uses a domain name of adatum.com.In Microsoft Entra, you set Guest invite restrictions to Only users assigned to specific admin roles can invite guest users.A user named user1@adatum.com reports that they can no longer invite external users from a domain named contoso.com to collaborate in Microsoft Teams.You need to modify the Microsoft Entra ID configuration to meet the following requirements: Ensure that User1 can invite the contoso.com users to Teams.Ensure that only the contoso.com users can be invited as guests to the Microsoft Entra tenant. Follow the principle of least privilege.What should you do for each requirement? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Assign the Guest Inviter role to User1. Limit who can invite guestsYou can limit who in your organization can invite guests. Guest accounts can be used for sharing teams, SharePoint sites, files, and folders with people outside your organization.If your business processes require that you limit who can share with guests, or if you want users to complete training before they're able to share with guests, you can limit who can share by using the Guest inviter role in Microsoft Entra ID.Box 2: From the External collaboration settings, edit the Collaboration restrictions settings. Allow or block invitations to B2B users from specific organizationsSign in to the Microsoft Entra admin center as at least a User administrator.Browse to Identity > Users > User settings.Under External users, select Manage external collaboration settings.Under Collaboration restrictions, select Deny invitations to the specified domains.Under Target domains, enter the name of one of the domains that you want to block. For multiple domains, enter each domain on a new line. For example:6. When you're done, select Save.
https://learn.microsoft.com/en-us/microsoft-365/solutions/limit-who-can-invite-guests https://learn.microsoft.com/en-us/azure/active-directory/external-identities/allow-deny-list
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory domain that is synced to a Microsoft Entra tenant as shown in the following exhibit.An on-premises Active Directory user account named Allan Yoo is synchronized to the Microsoft Entra tenant. You view Allan’s account from Microsoft 365 and notice that his username is set to Allan@adatum.onmicrosoft.com.For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: NoAllan Yoo’s user account is synchronized from the on-premise Active Directory. This means that most user account settings have to be configured in the on-premise Active Directory.In the exhibit, Password Writeback is disabled. Therefore, you cannot reset the password of Allan Yoo from the Azure portal.Box 2: NoYou also cannot change Allan Yoo’s job title in the Azure portal because his account is synchronized from the on-premise Active Directory.Box 3: YesOne setting that you can configure for synchronized user accounts I the usage location. The usage location must be configured on a user account before you can assign licenses to the user.
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback
Your network contains an on-premises Active Directory domain. The domain contains 2,000 computers that run Windows 11.You purchase a Microsoft 365 subscription.You implement password hash synchronization and Microsoft Entra Seamless Single Sign-On (Seamless SSO).You need to ensure that users can use Seamless SSO from the Windows 11 computers. What should you do?
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.