HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.You need to configure Privileged Identity Management (PIM) for the User Administrator role in Microsoft Entra. Eligible users must meet the following requirements:Always be able to request the User Administrator roleMust provide a reason when requesting the User Administrator roleMust require multi-factor authentication (MFA) when activating the User Administrator role The solution must minimize administrative effort.How should you configure the Role settings for each requirement? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Set allow permanent eligible assignment to yes Always be able to request the User Administrator roleSetting: Allow permanent eligible assignmentResource administrators can assign permanent eligible assignments.Box 2: Select Require justification on activationMust provide a reason when requesting the User Administrator roleRequire justification on activationYou can require users to enter a business justification when they activate the eligible assignment.Incorrect:Require justification on active assignmentYou can require that users enter a business justification when they create an active (as opposed to eligible) assignment.Incorrect:Require ticket information on activationYou can require users to enter a support ticket number when they activate the eligible assignment. This option is an information-only field. Correlation with information in any ticketing system isn't enforced.Box 3: Set On activation require to Azure MFAMust require multi-factor authentication (MFA) when activating the User Administrator roleOn activation, require multifactor authenticationYou can require users who are eligible for a role to prove who they are by using the multifactor authentication feature in Microsoft Entra ID before they can activate. Multifactor authentication helps safeguard access to data and applications. It provides another layer of security by using a second form of authentication.
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles- configure-role-settings
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.You need to create a Conditional Access policy that will require the use of FIDO2 security keys only when users join their Windows devices to Microsoft Entra ID.How should you configure the policy? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Cloud Apps Target resourcesConditional Access Policies for Entra Joined Devices, How does Conditional access policy work?Once the user logs in using Microsoft Entra (Azure AD previously) credentials to any cloud apps on Entra ID Joined (Azure AD joined previously) device and the device is a complaint as per corporation’s conditional access policies, then the user should be allowed access to use cloud apps without any blockage. On unenrolled devices if a user tries to access any cloud apps, then user access should be blocked and the user will be asked to enroll the device.Box 2: Device platforms ConditionsIn the Device platform select Windows as the platform so that the policy is applied on Windows devices only.Box 3: Require device to be marked as compliant Grant accessAccess control: This setting will help to allow access to users based on the selected criteria.In this section, select Require device to be marked as compliant, which means users will be able to access resources only when the device is enrolled to Azure as Entra ID joined and only if its device compliance status shows as compliant. If the device is not Joined or if it is not compliant then the policy should restrict the access of the user.Note: Microsoft offers the following three passwordless authentication options that integrate with Microsoft Entra ID:Microsoft Authenticator - turns any iOS or Android phone into a strong, passwordless credential by allowing users to sign into any platform or browser.FIDO2-compliant security keys - useful for users who sign in to shared machines like kiosks, in situations where use of phones is restricted, and for highly privileged identities.Windows Hello for Business - best for users on their dedicated Windows computers.
https://help.scalefusion.com/docs/conditional-access-policies-for-entra-joined-devices
You have a Microsoft 365 subscription.You need to implement a passwordless authentication solution that supports the following device types: WindowsAndroid iOSThe solution must use the same authentication method for all devices. Which authentication method should you use?
Answer(s): B
Correct:* FIDO2-compliant security keysVoice callIncorrect:* multi-factor authentication (MFA)* the Microsoft Authentication appWindows Hello for BusinessNote:Correct:FIDO2-compliant security keysMicrosoft applications provide native support for FIDO2 authentication in preview for all users who have an authentication broker installed for their operating system. The following tables lists which authentication brokers are supported for different operating systems.2 Native app support for FIDO2 on Android is in development. Microsoft Authentication Library (MSAL)If you aren't using MSAL, you should still use the system web browser for authentication. Features such as single sign-on and Conditional Access rely on a shared web surface provided by the system web browser. This means using Chrome Custom Tabs (Android) or Authenticating a User Through a Web Service | AppleDeveloper Documentation (iOS). Incorrect:multifactor authentication (MFA)Features like multifactor authentication (MFA) are a great way to secure your organization, but users often get frustrated with the additional security layer on top of having to remember their passwords.the Microsoft Authentication appThe Microsoft Authentication app does not work on Windows.The Authenticator App turns any iOS or Android phone into a strong, passwordless credential. Users can sign in to any platform or browser by getting a notification to their phone, matching a number displayed on the screen to the one on their phone, and then using their biometric (touch or face) or PIN to confirm.Note: To use passwordless phone sign-in with Microsoft Authenticator, the following prerequisites must be met:- Latest version of Microsoft Authenticator installed on devices running iOS or Android.- For Android, the device that runs Microsoft Authenticator must be registered to an individual user. We're actively working to enable multiple accounts on Android.Windows Hello for BusinessWindows Hello for Business is ideal for information workers that have their own designated Windows PC.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passwordless https://learn.microsoft.com/en-us/entra/identity/authentication/fido2-compatibility https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-phone
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains the users shown in the following table.You add the following assignment for the User Administrator role: Scope type: DirectorySelected members: Group1 Assignment type: Active Assignment starts: Mar 15, 2023Assignment ends: Aug 15, 2023You add the following assignment for the Exchange Administrator role: Scope type: DirectorySelected members: Group2 Assignment type: Eligible Assignment starts: Jun 15, 2023Assignment ends: Oct 15, 2023For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: YesAdmin1 is member of Group1.The User Administrator role assignment has Group1 as a member. The assignment type: ActiveJuly 15, 2023 is with the assignment period.A User Administrator can manage all aspects of users and groups, including resetting passwords for limited admins.Box 2: NoAdmin2 is member of Group2.The Exchange Administrator role assignment has Group2 as a member. The assignment type: EligibleJune 20, 2023 is with the assignment period. The assignment must be approved.Note: Eligible assignment requires member or owner to perform an activation to use the role. Activations may also require providing a multi-factor authentication (MFA), providing a business justification, or requesting approval from designated approvers.Box 3: YesAdmin3 is member of Gropu1 and Group2.The User Administrator role assignment has Group1 as a member. The assignment type: ActiveMay 1, 2023 is with the assignment period.
https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/groups-assign- member-owner
You have a Microsoft 365 subscription.You configure a new Microsoft Entra enterprise application named App1. App1 requires that a user be assigned the Reports Reader role.Which type of group should you use to assign the Reports Reader role and to access App1?
Answer(s): C
To grant permissions to assignees to manage users and group access for a specific enterprise app, go to that app in Microsoft Entra tetant and open in the Roles and Administrators list for that app. Select the new custom role and complete the user or group assignment. The assignees can manage users and group access only for the specific app.Note: You can add the following types of groups:Assigned groups - Manually add users or devices into a static group.Dynamic groups (Requires Microsoft Entra Premium) - Automatically add users or devices to user groups or device groups based on an expression you create.Note:Security groupsSecurity groups are used for granting access to Microsoft 365 resources, such as SharePoint. They can make administration easier because you need only administer the group rather than adding users to each resource individually.Security groups can contain users or devices. Creating a security group for devices can be used with mobile device management services, such as Intune.Security groups can be configured for dynamic membership in Microsoft Entra ID, allowing group members or devices to be added or removed automatically based on user attributes such as department, location, or title; or device attributes such as operating system version.Security groups can be added to a team.Microsoft 365 Groups can't be members of security groups. Microsoft 365 GroupsMicrosoft 365 Groups are used for collaboration between users, both inside and outside your company. With each Microsoft 365 Group, members get a group email and shared workspace for conversations, files, and calendar events, Stream, and a Planner.
https://learn.microsoft.com/en-us/azure/active-directory/roles/custom-enterprise-apps https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/compare-groups? https://learn.microsoft.com/en-us/mem/intune/apps/apps-deploy
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.