QUESTION: 53 Exam Topic: Implement identities in Azure AD Questions

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.

From the Groups blade in the Azure Active Directory admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.

You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

What should you use?

the Set-MsolUserLicensecmdlet
the Set-AzureADGroupcmdlet
the Set-WindowsProductKeycmdlet
the Administrative units blade in the Azure Active Directory admin center

Answer(s): A

Reveal Solution Next Question

QUESTION: 54 Exam Topic: Implement identities in Azure AD Questions

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.

From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to a group that includes all the users.

You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

What should you use?

the Set-AzureADGroupcmdlet
the Identity Governance blade in the Azure Active Directory admin center
the Set-WindowsProductKeycmdlet
the Set-MsolUserLicensecmdlet

Answer(s): D

Reference:

https://learn.microsoft.com/en-us/powershell/module/msonline/set-msoluserlicense?view=azureadps-1.0

Reveal Solution Next Question

QUESTION: 55 Exam Topic: Implement identities in Azure AD Questions

HOTSPOT (Drag and Drop is not supported)
Your on-premises network contains an Active Directory domain that uses Azure AD Connect to sync with an Azure AD tenant.

You need to configure Azure AD Connect to meet the following requirements:

-User sign-ins to Azure AD must be authenticated by an Active Directory domain controller.
-Active Directory domain users must be able to use Azure AD self-service password reset (SSPR).

What should you use for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Pass-through authentication

User sign-ins to Azure AD must be authenticated by an Active Directory domain controller.
Pass-through authentication
Pass-through authentication (PTA) - This option is similar to password hash sync, but provides a simple password validation using on-premises software agents for organizations with strong security and compliance policies.

Azure AD Pass-through Authentication.Provides a simple password validation for Azure AD authentication services by using a software agent that runs on one or more on-premises servers. The servers validate the users directly with your on-premises Active Directory, which ensures that the password validation doesn't happen in the cloud.

Incorrect:
* Federation authentication
Federated authentication - When you choose this authentication method Azure AD will hand off the authentication process to a separate trusted authentication system, such as AD FS or a third-party federation system, to validate the user's sign-in.

* Password Hash Sync enables users to use the same username and password that they use on-premises without having to deploy any additional infrastructure besides Azure AD Connect.

Note: Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity. Azure AD Connect synchronizes a hash of a user's password from an on-premises Active Directory instance to a cloud-based Azure AD instance.

Password hash synchronization is an extension to the directory synchronization feature implemented by Azure AD Connect sync. You can use this feature to sign in to Azure AD services like Microsoft 365. You sign in to the service by using the same password you use to sign in to your on-premises Active Directory instance.

Box 2: Password writeback
Active Directory domain users must be able to use Azure AD self-service password reset (SSPR).

Enable password writeback for SSPR
With password writeback enabled in Azure AD Connect, now configure Azure AD SSPR for writeback. SSPR can be configured to writeback through Azure AD Connect sync agents and Azure AD Connect provisioning agents (cloud sync). When you enable SSPR to use password writeback, users who change or reset their password have that updated password synchronized back to the on-premises AD DS environment as well.

Reference:

https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs
https://learn.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-user-signin
https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr-writeback

Reveal Solution Next Question

QUESTION: 56 Exam Topic: Implement identities in Azure AD Questions

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.

From the Groups blade in the Azure Active Directory admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.

You needed to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.

What should you use?

the Groups blade in the Azure Active Directory admin center
the Set-AzureADGroupcmdlet
the Identity Governance blade in the Azure Active Directory admin center
the Set-MsolUserLicensecmdlet

Answer(s): D

Explanation:

To remove all licenses from a group of existing licensed users, use either of the following methods:

Filter the accounts based on an existing account attribute To do this, use the following syntax:

$userArray = Get-MsolUser -All <FilterableAttributes> | where {$_.isLicensed -eq $true}
for ($i=0; $i -lt $userArray.Count; $i++)
{
Set-MsolUserLicense -UserPrincipalName $userArray[$i].UserPrincipalName -RemoveLicenses $userArray[$i].licenses.accountskuid
}
This example removes all licenses from all user accounts in the Sales department in the United States.

$userArray = Get-MsolUser -All -Department "Sales" -UsageLocation "US" | where {$_.isLicensed -eq $true}
for ($i=0; $i -lt $userArray.Count; $i++)
{
Set-MsolUserLicense -UserPrincipalName $userArray[$i].UserPrincipalName -RemoveLicenses $userArray[$i].licenses.accountskuid
}

Reference:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/remove-licenses-from-user-accounts-with-microsoft-365-powershell

Reveal Solution Next Question

Free SC-300 Exam Braindumps (page: 14)

QUESTION: 53 Exam Topic: Implement identities in Azure AD Questions

QUESTION: 54 Exam Topic: Implement identities in Azure AD Questions

Reference:

QUESTION: 55 Exam Topic: Implement identities in Azure AD Questions

Explanation:

Reference:

QUESTION: 56 Exam Topic: Implement identities in Azure AD Questions

Explanation:

Reference: