HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.You need to create a Conditional Access policy named Policy1 that meets the following requirements: Applies to high-risk usersRequires multifactor authentication (MFA)Which two settings should you configure? To answer, select the appropriate settings in the answer area.NOTE: Each correct selection is worth one point.Hot Area:03CDC095F9FEFF732D90886CB388BC30
Answer(s): A
03CDC095F9FEFF732D90886CB388BC3003CDC095F9FEFF732D90886CB388BC30Box 1: UsersApplies to high-risk usersThere are two types of risk policies in Microsoft Entra Conditional Access you can set up. You can use these policies to automate the response to risks allowing users to self-remediate when risk is detected:Sign-in risk policy User risk policyUser risk policy in Conditional Access1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.2. Browse to Protection > Conditional Access.3. Select New policy.4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.Under Assignments, select Users or workload identities. 5a. Under Include, select All users.5b. Under Exclude, select Users and groups and choose your organization's emergency access or break- glass accounts.5c. Select Done.6. Etc.Box 2: GrantRequires multifactor authentication (MFA)How To: Configure the multifactor authentication registration policyUnder Access controls > Grant, select Grant access, Require multifactor authentication, and select Select.
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-policy-all-users- mfa
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.You plan to create a Conditional Access policy named Policy1.You need to ensure that only Passwordless MFA authentication methods are used when administrators attempt to access the Azure portal. Azure PowerShell, or Azure Command-Line Interface (CLI).How should you configure Policy1? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Set Grant to Require authentication strength. Access controlsConditional Access authentication strengthAuthentication strength is a Conditional Access control that specifies which combinations of authentication methods can be used to access a resource. Users can satisfy the strength requirements by authenticating with any of the allowed combinations.Authentication strengthsAdministrators can specify an authentication strength to access a resource by creating a Conditional Access policy with the Require authentication strength control. They can choose from three built-in authentication strengths: Multifactor authentication strength, Passwordless MFA strength, and Phishing-resistant MFA strength. They can also create a custom authentication strength based on the authentication method combinations they want to allow.Box 2: Windows Azure Service Management API Target resourcesConditional Access: Target resourcesTarget resources (formerly Cloud apps, actions, and authentication context) are key signals in a Conditional Access policy. Conditional Access policies allow administrators to assign controls to specific applications, services, actions, or authentication context.Windows Azure Service Management APIWhen you target the Windows Azure Service Management API application, policy is enforced for tokens issued to a set of services closely bound to the portal. This grouping includes the application IDs of:Azure Resource ManagerAzure portal, which also covers the Microsoft Entra admin center Azure Data LakeApplication Insights API Log Analytics APIBecause the policy is applied to the Azure management portal and API, services, or clients with an Azure API service dependency, can indirectly be impacted. For example:Azure CLIAzure Data Factory portal Azure DevOpsAzure Event Hubs Azure PowerShell Azure Service Bus Azure SQL Database Azure SynapseClassic deployment model APIs Microsoft 365 admin center Microsoft IoT CentralSQL Managed InstanceVisual Studio subscriptions administrator portal
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that contains the users shown in the following table.You configure a Multifactor authentication registration policy that has the following settings: Assignments:- Include: Group1Exclude: Group2Controls: Require Microsoft Entra multifactor authentication registration Policy enforcement: EnabledYou create a conditional access policy that has the following settings: Name: Policy1Assignments:- Include: Group2- Exclude: Group1Grant: Require multifactor authentication Enable policy: OnFor each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Based on the information provided in the table and conditional access policies setup, the correct answers for each statement should be evaluated based on the inclusion and exclusion criteria:User1 will be required to register for MFA on the next sign-in.Yes: Since User1 is part of Group1, which is included in the MFA registration policy, and is not excluded from it, User1 will be required to register for MFA.User2 will be required to register for MFA on the next sign-in.No: User2 is part of both Group1 (included) and Group2 (excluded). Since Group2 is excluded from the MFA registration policy, User2 will not be required to register for MFA.User3 will be required to register for MFA on the next sign-in.No: User3 is part of Group2, which is excluded from the MFA registration policy, so User3 will not be required to register for MFA.
Your network contains an Active Directory domain named adatum.com that is synced to a Microsoft Entra tenant.The domain contains 100 user accounts.The city attribute for all the users is set to the city where the user resides.You need to modify the value of the city attribute to the three-letter airport code of each city. What should you do?
Answer(s): D
Correct:* From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings.From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.Incorrect:* From Azure Cloud Shell, run the Get-ADUser and Set-ADUser cmdlets.* From Azure Cloud Shell, run the Get-MgUser and Update-MgUser cmdlets.* From Azure Cloud Shell, run the Get-MsolUser and Set-MsolUser cmdlets.* From the Azure portal, select all the Microsoft Entra users, and then use the User settings blade.* From the Microsoft 365 admin center, select the users, and then use the Bulk actions option.From the Microsoft Entra admin center, select all the Microsoft Entra users, and then use the User settings blade.Need to update the user in Active Directory.* From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.From Windows PowerShell on a domain controller, run the Get-MgUser and Update-MgUser cmdlets.Explanations for correct answers:From Windows PowerShell on a domain controller, run the Get-ADUser and Set-ADUser cmdlets.The user accounts are synced from the on-premise Active Directory to the Microsoft Entra ID. Therefore, the city attribute must be changed in the on-premise Active Directory.You can use Windows PowerShell on a domain controller and run the Get-ADUser cmdlet to get the required users and pipe the results into Set-ADUser cmdlet to modify the city attribute.* From Active Directory Administrative Center, select the Active Directory users, and then modify the Properties settings.The user accounts are synced from the on-premise Active Directory to the Microsoft Entra ID. Therefore, the city attribute must be changed in the on-premise Active Directory.You can modify certain attributes of multiple user accounts simultaneously by selecting them in Active Directory Administrative Center or Active Directory Users and Computers, right clicking then selecting Properties.
https://docs.microsoft.com/en-us/powershell/module/addsadministration/set-aduser https://blogs.technet.microsoft.com/canitpro/2015/11/25/step-by-step-managing-multiple-user-accounts-via- active-directory-admin-center/
HOTSPOT (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription.You need to enable passwordless authentication for all users.Which authentication method and portal should you use? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Authenticator Authentication methodEnable passwordless sign-in with Microsoft AuthenticatorMicrosoft Authenticator can be used to sign in to any Microsoft Entra account without using a password. Microsoft Authenticator uses key-based authentication to enable a user credential that is tied to a device, where the device uses a PIN or biometric. Windows Hello for Business uses a similar technology.Box 2: Microsoft Entra admin center PortalTo enable the authentication method for passwordless phone sign-in, complete the following steps:Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.Browse to Protection > Authentication methods > Policies.Under Microsoft Authenticator, choose the following options:3a. Enable - Yes or No3b. Target - All users or Select usersEach added group or user is enabled by default to use Microsoft Authenticator in both passwordless and push notification modes ("Any" mode). To change the mode, for each row for Authentication mode - choose Any, or Passwordless. Choosing Push prevents the use of the passwordless phone sign-in credential.5. To apply the new policy, click Save.
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-phone
Post your Comments and Discuss Microsoft MS-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MS-102 content, but please register or login to continue.