Your company has a Microsoft Entra tenant named contoso.com and a Microsoft 365 subscription. All users use Windows 10 devices to access Microsoft Office 365 apps.All the devices are in a workgroup.You plan to implement password less sign-in to contoso.com.You need to recommend changes to the infrastructure for the planned implementation. What should you include in the recommendation?
Answer(s): A
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains two security groups named Group1 and Group2.You need to enable multi-factor authentication (MFA) for the members of Group1 and Group2. The solution must meet the following requirements:The Group1 members must be prompted for MFA only when authenticating to Microsoft Entra ID from Android devices.The Group2 members must be prompted for MFA only when accessing Microsoft Exchange Online from outside the corporate network.Administrative effort must be minimized.What should you configure for each group? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Entra security defaultsThe Group1 members must be prompted for MFA only when authenticating to Microsoft Entra ID from Android devices.How to enable and use Microsoft Entra multifactor authenticationYou can use security defaults in Microsoft Entra tenants to quickly enable Microsoft Authenticator for all users. You can enable Microsoft Entra multifactor authentication to prompt users and groups for additional verification during sign-in.For more granular controls, you can use Conditional Access policies to define events or applications that require MFA. These policies can allow regular sign-in when the user is on the corporate network or a registered device but prompt for additional verification factors when the user is remote or on a personal device.Box 2: Conditional AccessThe Group2 members must be prompted for MFA only when accessing Microsoft Exchange Online from outside the corporate network.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks
DRAG DROP (Drag and Drop is not supported)You have an Azure subscription that is linked to a hybrid Microsoft Entra tenant.All users sync from Active Directory Domain Services (AD DS) to the tenant by using Express Settings in Microsoft Entra Connect.You plan to implement self-service password reset (SSPR).You need to ensure that when a user resets or changes a password, the password syncs with AD DS.Which actions should you perform in sequence? To answer, drag the appropriate actions to the correct order. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:
Step 1: From the Microsoft Entra admin center, configure the registration settings for SSPR Enable self-service password resetMicrosoft Entra ID lets you enable SSPR for None, Selected, or All users. This granular ability lets you choose a subset of users to test the SSPR registration process and workflow. When you're comfortable with the process and the time is right to communicate the requirements with a broader set of users, you can select a group of users to enable for SSPR. Or, you can enable SSPR for everyone in the Microsoft Entra tenant.Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.Browse to Protection > Password reset from the menu on the left side.From the Properties page, under the option Self service password reset enabled, choose Selected.If your group isn't visible, choose No groups selected, browse for and select your Microsoft Entra group, like SSPR-Test-Group, and then choose Select.5. To enable SSPR for the select users, select Save.Step 2: Select Password writeback in Microsoft Entra connect Enable password writeback in Microsoft Entra ConnectOne of the configuration options in Microsoft Entra Connect is for password writeback. When this option is enabled, password change events cause Microsoft Entra Connect to synchronize the updated credentials back to the on-premises AD DS environment.To enable SSPR writeback, first enable the writeback option in Microsoft Entra Connect. From your Microsoft Entra Connect server, complete the following steps:Sign in to your Microsoft Entra Connect server and start the Microsoft Entra Connect configuration wizard.On the Welcome page, select Configure.On the Additional tasks page, select Customize synchronization options, and then select Next.On the Connect to Microsoft Entra ID page, enter a Global Administrator credential for your Azure tenant, and then select Next.On the Connect directories and Domain/OU filtering pages, select Next.On the Optional features page, select the box next to Password writeback and select Next.7. Etc.Step 3: From the Microsoft Entra admin center, configure on-premises integration password writeback Enable password writeback for SSPRWith password writeback enabled in Microsoft Entra Connect, now configure Microsoft Entra SSPR for writeback. SSPR can be configured to writeback through Microsoft Entra Connect Sync agents and Microsoft Entra Connect provisioning agents (cloud sync). When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well.To enable password writeback in SSPR, complete the following steps:Sign in to the Microsoft Entra admin center as Global Administrator.Browse to Protection > Password reset, then choose On-premises integration. (Step 2)Check the option for Write back passwords to your on-premises directory .(optional) If Microsoft Entra Connect provisioning agents are detected, you can additionally check the option for Write back passwords with Microsoft Entra Connect cloud sync.Check the option for Allow users to unlock accounts without resetting their password to Yes.6. When ready, select Save.
https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr-writeback
You have two Microsoft 365 tenants. Users have accounts in both tenants.You plan to deploy a single device to each user. Each device will contain the Microsoft Authenticator app.You need to ensure that the users can use their device to authenticate to both tenants by using passwordless authentication.Which platform should you provide?
The Authenticator App turns any iOS or Android phone into a strong, passwordless credential.Multiple accounts on iOSYou can enable passwordless phone sign-in for multiple accounts in Microsoft Authenticator on any supported iOS device. Consultants, students, and others with multiple accounts in Microsoft Entra ID can add each account to Microsoft Authenticator and use passwordless phone sign-in for all of them from the same iOS device.Previously, admins might not require passwordless sign-in for users with multiple accounts because it requires them to carry more devices for sign-in. By removing the limitation of one user sign-in from a device, admins can more confidently encourage users to register passwordless phone sign-in and use it as their default sign-in method.
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-phone
Your network contains an Active Directory domain named adatum.com that is synced to a Microsoft Entratenant.The domain contains 100 user accounts.The city attribute for all the users is set to the city where the user resides.You need to modify the value of the city attribute to the three-letter airport code of each city. What should you do?
For this question these are the correct answers:* From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings.From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.For this question these are the incorrect answers:* From Azure Cloud Shell, run the Get-ADUser and Set-ADUser cmdlets.* From Azure Cloud Shell, run the Get-MgUser and Update-MgUser cmdlets.* From Azure Cloud Shell, run the Get-MsolUser and Set-MsolUser cmdlets.* From the Azure portal, select all the Microsoft Entra users, and then use the User settings blade.* From the Microsoft 365 admin center, select the users, and then use the Bulk actions option.From the Microsoft Entra admin center, select all the Microsoft Entra users, and then use the User settings blade.Need to update the user in Active Directory.* From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets. Explanations for correct answers:From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.The user accounts are synced from the on-premise Active Directory to the Microsoft Entra ID. Therefore, the city attribute must be changed in the on-premise Active Directory.You can use Windows PowerShell on a domain controller and run the Get-ADUser cmdlet to get the required users and pipe the results into Set-ADUser cmdlet to modify the city attribute.From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings.The user accounts are synced from the on-premise Active Directory to the Microsoft Entra ID. Therefore, the city attribute must be changed in the on-premise Active Directory.You can modify certain attributes of multiple user accounts simultaneously by selecting them in Active Directory Administrative Center or Active Directory Users and Computers, right clicking then selecting Properties.
https://docs.microsoft.com/en-us/powershell/module/addsadministration/set-aduser https://blogs.technet.microsoft.com/canitpro/2015/11/25/step-by-step-managing-multiple-user-accounts-via- active-directory-admin-center/
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.