Question 1

An administrator wants to create a group they can assign the Helpdesk Administrator role to, and they want the group's membership to populate automatically using a dynamic rule based on job title. In the group creation blade, when they set "Microsoft Entra roles can be assigned to the group" to Yes, the dynamic membership option becomes unavailable. Why can these two settings not be combined?

Accepted Answer

Correct answer: A. Only groups created with the isAssignableToRole property set to true can be assigned Microsoft Entra roles, and that property is immutable. A core restriction of role-assignable groups is that their membership type must be Assigned and cannot be dynamic. Microsoft designed it this way to prevent elevation of privilege: if dynamic membership were allowed, anyone who could modify the attributes referenced in the rule could add an account to the group and thereby grant it the assigned role. Creating a role-assignable group also requires at least the Privileged Role Administrator role.

Question 2

An administrator uses group-based licensing to assign Microsoft 365 E5 to a parent security group named All-Staff. All-Staff contains a nested child group, Contractors, whose members belong only through that child group. After processing, direct members of All-Staff receive licenses but the contractors do not. Separately, several users who had no Usage location set still received their licenses. Which statement correctly explains both behaviors?

Accepted Answer

Correct answer: C. Group-based licensing does not support nested groups. If you assign licenses to a group that contains other groups, only the first-level (direct) user members are licensed; members who belong only through a nested child group are not. Separately, although a direct per-user license assignment fails without a Usage location, under group-based licensing any user without a location inherits the tenant's location, so licensing still succeeds for those users.

Question 3

An organization currently has only Microsoft Entra ID Free. The security team wants to create a custom role that grants a narrow set of permissions (for example, managing app registration credentials) and assign it to three engineers. What licensing applies to this plan?

Accepted Answer

Correct answer: C. Using built-in Microsoft Entra roles is free, but custom roles require a Microsoft Entra ID P1 license for every user who holds a custom role assignment. Microsoft Learn's licensing page states this directly, and the custom-role creation prerequisites list a P1 or P2 license plus the Privileged Role Administrator role. So the three engineers assigned the custom role each need P1 coverage; the organization cannot do this on Free alone.

Question 4

A company must guarantee that Helpdesk Administrators and even tenant-level Global Administrators cannot reset the passwords of C-level executive accounts or read their BitLocker keys, without stripping those admins of their tenant-wide roles. Only a small, explicitly designated set of administrators should be able to manage the executive accounts. Which Microsoft Entra capability meets this requirement?

Accepted Answer

Correct answer: B. A restricted management administrative unit protects specific objects so that only administrators explicitly assigned a role at the scope of that unit can modify them. Even tenant-level Global Administrators and Privileged Role Administrators are blocked from modifying the objects unless they scope themselves to the unit, which is an auditable event. Placing the executive accounts in a restricted management administrative unit and assigning the trusted administrators a role (for example, Authentication Administrator) at that scope meets the requirement without removing anyone's tenant-wide roles.

Question 5

An administrator reviews the Identity Secure Score in Microsoft Entra ID and finds the recommendation 'Require MFA for administrative roles' shows a low score. The administrator implements MFA for all administrator accounts. How frequently does the Identity Secure Score recalculate, and where does the score appear relative to the overall Microsoft Secure Score?

Accepted Answer

Correct answer: C. The Identity Secure Score evaluates your security configuration every 24 hours and computes a new score based on how closely your settings align with Microsoft's recommendations. The score is available in the Microsoft Entra admin center under Identity Secure Score and also under Recommendations. It directly corresponds to the identity category within the Microsoft Secure Score, which has five categories: Identity, Data, Devices, Infrastructure, and Apps. Improvements to the Identity Secure Score improve the identity component of the overall Microsoft Secure Score.

Question 6

A licensing operations team must be able to assign and remove Microsoft 365 licenses for users, but they should not be able to create or delete users, reset passwords, or purchase subscriptions. Following least privilege, which Microsoft Entra role should you assign?

Accepted Answer

Correct answer: D. License Administrator is the least-privileged role for assigning and removing user and group licenses. Microsoft Learn's least-privileged-roles-by-task reference lists License Administrator as the minimum role for both "Assign license" and "Revoke license." It grants the ability to manage license assignments (and read license configuration) without the broader user-management or purchasing powers that other roles carry, which fits the requirement exactly.

Question 7

To reduce casual directory browsing, an administrator sets 'Restrict access to the Microsoft Entra admin center' to Yes for non-admin users. A security reviewer asks whether this reliably prevents those users from reading directory data. What is the correct understanding of this setting?

Accepted Answer

Correct answer: C. 'Restrict access to the Microsoft Entra admin center' only limits access to a set of commonly visited admin center pages for non-admin users. Microsoft is explicit that this is not a security measure: it does not block programmatic access to Microsoft Entra data via PowerShell, the Microsoft Graph API, or other tools, and many pages remain reachable through direct links. For real enforcement, Microsoft recommends a Conditional Access policy targeting the Windows Azure Service Management API.

Question 8

During a reorganization, an administrator changes an Azure subscription's associated Microsoft Entra directory (tenant) from Tenant A to Tenant B. Which statement best describes the result of this change?

Accepted Answer

Correct answer: D. Every Azure subscription has a trust relationship with exactly one Microsoft Entra tenant at a time (though one tenant can be trusted by many subscriptions). Changing the subscription's directory changes which tenant supplies identities for Azure RBAC. Microsoft Learn warns that when a subscription is associated with a different directory, users who had access through Azure role assignments lose that access, and classic administrators lose access too. It does not move user accounts between tenants; it only re-points which identity store Azure checks for that subscription.

Question 9

An organization set Guest invite settings to 'Only users assigned to specific admin roles can invite guest users.' A project lead who holds no administrator role now needs to invite external partners as B2B guests, but must not receive any broader directory privileges. Which role should you assign?

Accepted Answer

Correct answer: D. The Guest Inviter role gives an individual user the ability to invite B2B guests without assigning a higher-privilege administrator role. Users with the Guest Inviter role can invite guests even when 'Only users assigned to specific admin roles can invite guest users' is selected. It carries no other directory-management permissions, so it exactly meets the least-privilege requirement.

Question 10

A cloud engineer holds the Microsoft Entra User Administrator role. They can manage users and groups in the Entra admin center, but in the Azure portal they cannot start, stop, or resize the virtual machines in a resource group. What correctly explains this and the appropriate fix?

Accepted Answer

Correct answer: C. Microsoft Entra roles and Azure RBAC are independent authorization systems. Microsoft Entra roles control access to directory resources (users, groups, applications) through Microsoft Graph, while Azure RBAC controls access to Azure resources (VMs, storage) through Azure Resource Manager. Entra role permissions can't be used in Azure and vice versa. To let the engineer manage the VMs, assign an Azure RBAC role like Virtual Machine Contributor; Azure RBAC scope can be a management group, subscription, resource group, or individual resource.

Question 11

An administrator adds a security group to an administrative unit and assigns a User Administrator scoped to that unit. A support technician in that role needs to reset the password of a user who is a member of the group. The user object itself has NOT been added directly to the administrative unit. What is the result when the technician attempts the password reset?

Accepted Answer

Correct answer: A. Adding a group to an administrative unit brings the group object itself into the management scope of the administrative unit, but it does not bring the group's members into scope. A User Administrator scoped to the administrative unit can manage the group's properties and membership, but cannot manage individual user properties or reset passwords for group members unless those users are also directly added as members of the administrative unit.

Question 12

You enable group-based licensing on a security group named 'All-Staff.' 'All-Staff' contains several other groups as members (nested groups). Users who are direct members of 'All-Staff' receive licenses, but users who are only members of the nested child groups do not. Why?

Accepted Answer

Correct answer: D. Group-based licensing doesn't currently support nested groups. If you assign licenses to a group that contains other groups, only users in the first-level (direct) group receive licenses; members of nested child groups are not licensed.

Question 13

A collaboration lead wants end users to create and own their own security groups from the My Groups portal, and to let group owners approve or deny join requests, without granting users any admin role. In Microsoft Entra group settings, which change is needed, and what license is required for the request-to-join and approval behavior?

Accepted Answer

Correct answer: B. Setting the tenant option 'Users can create security groups' to Yes lets non-admin users create and own security groups (including from the My Groups portal). However, a Microsoft Entra ID P1 or P2 license is required for users to request to join a security or Microsoft 365 group and for owners to approve or deny those membership requests. Without P1/P2, users can still manage groups they own but cannot use the join-request/approval flow.

Question 14

To pre-stage onboarding, you want a dynamic membership group that automatically contains users whose employment start date falls within the next 7 days, so licenses and access provision before Day 1. Which membership rule works?

Accepted Answer

Correct answer: D. employeeHireDate is the date/time property that supports comparison against the system.now keyword using -ge/-le together with the -plus <duration> operator, where the duration is ISO 8601 (for example p7d = 7 days). Bounding the value between system.now and system.now -plus p7d, and joining the two expressions with the hyphenated -and logical operator, selects users whose hire date falls within the next seven days.

Question 15

Fabrikam and Contoso configure a mutual B2B direct connect trust. A Contoso Teams shared channel owner adds a Fabrikam user to a shared channel. What is true about how that Fabrikam user is represented and managed in Contoso?

Accepted Answer

Correct answer: A. B2B direct connect users don't have a presence (no user object) in the resource organization's Entra directory. They access only the shared channel using their home-tenant credentials and are managed inside the Teams client by the shared channel owner. B2B collaboration guests, by contrast, do get a user object.

Question 16

Your organization uses Conditional Access with a named location policy that blocks access from outside trusted IP ranges. A user working from a coffee shop loses access to Exchange Online immediately after moving locations, even though their access token has not expired. Which feature is responsible for this near-real-time enforcement?

Accepted Answer

Correct answer: C. Continuous access evaluation enables resource providers such as Exchange Online to synchronize key Conditional Access policies and evaluate them in near real time. When a user moves outside a trusted IP range, the resource provider detects the location change and issues a 401 claim challenge, forcing the client to request a new token from Microsoft Entra. This results in immediate or near-immediate loss of access rather than waiting for the one-hour default token lifetime to expire. CAE-enabled sessions also use long-lived tokens of up to 28 hours, with security enforced through real-time event evaluation rather than short token lifetimes.

Question 17

A SOC analyst turns on Microsoft Entra ID Protection and expects a 'Leaked credentials' risk detection to appear in the Risk detections report within a minute of a user's password showing up in a breach dump. Several hours pass before it appears. Which statement correctly explains the timing?

Accepted Answer

Correct answer: C. ID Protection calculates some risks in real time and others offline. Real-time detections surface details in roughly 5-10 minutes, while offline detections can take up to 48 hours because they are evaluated after authentication. Leaked credentials is an offline detection (Microsoft matches credential pairs found in breach sources against the tenant), so a delay of hours is normal and expected rather than a fault.

Question 18

A Conditional Access policy requires a custom authentication strength that includes ONLY Windows Hello for Business. On a shared Windows device, a user signed in to Windows with a password (not Windows Hello) as their primary method, then opens an application protected by this policy. What is the expected behavior?

Accepted Answer

Correct answer: D. This is a documented Windows Hello for Business behavior for authentication strengths: if the user signed in with a different primary method (such as a password), Microsoft Entra ID does not prompt them to switch to Windows Hello for Business. The user must restart the session, choose Sign-in options, and select a method that the authentication strength requires.

Question 19

An organization historically enabled MFA per user (legacy per-user MFA). They now have a Conditional Access policy that requires MFA for all users and want to follow Microsoft's 'switch from per-user MFA to Conditional Access' recommendation. After confirming the Conditional Access policy covers everyone, what final step completes the migration?

Accepted Answer

Correct answer: C. The recommendation's action plan is to first require MFA through a Conditional Access policy that covers your users, then ensure the per-user MFA configuration is turned off by setting each affected user's per-user MFA state to Disabled in Users, then Per-user MFA. Leaving users Enabled or Enforced keeps the legacy per-user prompts active alongside Conditional Access.

Question 20

An organization has Conditional Access policies that enforce location-based controls using named IP locations. A user is authenticated from an allowed IP range. Their access token is valid. The user then moves to a different physical location, and their outbound IP changes to one outside the trusted range. Using Continuous Access Evaluation with IP-based location policies, which type of named location condition is enforced in near real time when the IP changes?

Accepted Answer

Correct answer: D. CAE only has insight into IP-based named locations defined by IPv4 and IPv6 address ranges. When a user moves outside these ranges and the resource provider detects the IP change, CAE can enforce the location policy near-real-time by issuing a claim challenge. CAE does not have insight into country/region-based locations or the MFA trusted IPs feature in the legacy MFA service settings page. If only country/region or MFA trusted IP locations are used, CAE issues a standard one-hour token without real-time IP enforcement.

Question 21

A company is deploying Microsoft Entra Password Protection for its on-premises Active Directory environment. The security team wants to ensure that domain controllers never communicate directly with the internet as part of this deployment. Which component fulfills this network isolation requirement?

Accepted Answer

Correct answer: C. On-premises Microsoft Entra Password Protection is designed so that domain controllers never communicate directly with the internet. The DC Agent service requests password policies from the Microsoft Entra Password Protection Proxy service using RPC over TCP within the local network. The Proxy service then communicates with Microsoft Entra ID on the internet and returns the policy to the DC Agent. The DC Agent never listens on a network-accessible port and the Proxy service is stateless.

Question 22

A Conditional Access administrator builds one policy with two grant controls selected: Require multifactor authentication and Require device to be marked as compliant. The intent is that a user is granted access if they satisfy EITHER control. Which configuration achieves this, and what is the default behavior when multiple controls are selected?

Accepted Answer

Correct answer: A. When multiple grant controls are selected, Conditional Access offers Require all the selected controls (a logical AND) or Require one of the selected controls (a logical OR). By default, Conditional Access requires all selected controls. To let users in when they satisfy either MFA or a compliant device, the admin must explicitly change the setting to Require one of the selected controls.

Question 23

An administrator builds one Conditional Access policy: 'If a user in the Finance group accesses the Payroll app, require MFA and a compliant device.' During a review, they discover that users who are NOT in Finance are still able to obtain access tokens for the Payroll app. The Finance policy is enabled and working. Why are non-Finance users getting in, and what is the correct fix?

Accepted Answer

Correct answer: B. Conditional Access is not restrictive by default: access tokens are issued whenever no policy condition triggers an access control. A policy that grants access with conditions to a specific subset (Finance accessing Payroll) only governs that subset; it says nothing about everyone else, so non-Finance users fall through and receive tokens. That coverage gap is the trap this question sets. The fix is a complementary policy that blocks non-Finance users from Payroll (Microsoft's own example pairs a Finance grant policy with a 'not-Finance, block' policy), or enforcing authorization at the application layer. The Conditional Access gap analyzer workbook helps surface apps and users with no policy coverage.

Question 24

In an Azure Public (commercial) tenant, an administrator opens Password protection to review smart lockout without customizing any value. What are the default smart lockout threshold and lockout duration?

Accepted Answer

Correct answer: D. Smart lockout is always on. For Azure Public (commercial) tenants the default lockout threshold is 10 failed attempts and the default lockout duration is 60 seconds (one minute), and the duration increases with each subsequent lockout. Azure US Government tenants default to a threshold of 3. Customizing these values requires Microsoft Entra ID P1.

Question 25

An administrator needs to exclude a specific fleet of Teams Room devices (tagged with a custom extension attribute) from an MFA-requiring Conditional Access policy. In the policy Conditions, they see a 'Device state (deprecated)' condition and a 'Filter for devices' condition. Which should they use, and what constraint applies?

Accepted Answer

Correct answer: D. The Device state condition is deprecated, and Microsoft directs customers to use the Filter for devices condition instead. Filter for devices lets you include or exclude devices based on a rule expression over device properties (such as trustType, isCompliant, deviceOwnership, model, manufacturer, or extension attributes), authored with the rule builder or syntax similar to dynamic group rules. A key constraint: Device state and Filter for devices cannot both be used in the same Conditional Access policy. Filter for devices provides more granular targeting, which is exactly what tagging the Teams Room fleet by extension attribute needs.

Question 26

A security administrator is reviewing the Microsoft Entra ID Protection reports and wants to dismiss a user risk detection that was confirmed as a false positive. Which role is the minimum required to dismiss user risk in Microsoft Entra ID Protection?

Accepted Answer

Correct answer: B. The Security Operator role can view all ID Protection reports and perform remediation actions including dismissing user risk, confirming safe sign-ins, and confirming compromise. The Security Reader role can view reports but cannot take action on risks. The Global Reader role also provides read-only access with no ability to update risks. The User Administrator can reset user passwords but cannot read or write to ID Protection policies or risk data.

Question 27

A security engineer is asked to make passkey (FIDO2) security keys available to a pilot group of finance users in Microsoft Entra ID. The engineer wants to use the least-privileged role and the current, supported control surface. Which role and location should the engineer use to enable the method?

Accepted Answer

Correct answer: D. Which authentication methods exist in the tenant and who may register them is governed by the Authentication methods policy, edited by an Authentication Policy Administrator. To enable passkeys, the admin browses to Entra ID, then Authentication methods, then Policies, selects Passkey (FIDO2), turns on the Enable toggle, and targets the pilot group under Include. This is the canonical, current control plane, and passkey (FIDO2) is a method that does not even exist in the legacy MFA service settings.

Question 28

You must grant an engineer the least-privileged Microsoft Entra built-in role that lets them enable passkeys (FIDO2) and Temporary Access Pass in the tenant-wide Authentication methods policy, without granting broad identity administration or the ability to reset arbitrary users' credentials. Which role should you assign?

Accepted Answer

Correct answer: C. Managing the tenant-wide Authentication methods policy (enabling methods such as FIDO2 passkeys and TAP and their configuration) requires the Authentication Policy Administrator role. Microsoft Learn explicitly directs admins to sign in 'as at least an Authentication Policy Administrator' to configure this policy, and this is the least-privileged role for the task.

Question 29

An administrator creates a named location defined by Countries/Regions and wants to select 'Mark as trusted location' so that sign-ins from it lower Microsoft Entra ID Protection risk and can be referenced as a trusted location in policies. The 'Mark as trusted location' option is not available for this named location. What is the correct explanation?

Accepted Answer

Correct answer: B. Named locations can be defined by IPv4/IPv6 address ranges or by countries/regions, but the 'Mark as trusted location' option is offered only when you define the location by IP address ranges. When you define a location by country/region, the only extra option is whether to include unknown areas; there is no trusted designation. Trusted (IP-based) locations are used by Conditional Access to include or exclude, and sign-ins from them improve the accuracy of ID Protection's risk calculation. Because CAE and trusted-location behaviors key off IP-based locations, country/region locations cannot be marked trusted.

Question 30

A resource tenant invites B2B guests from a partner Microsoft Entra tenant. The guests already perform MFA in their home tenant, and the organization wants to avoid challenging them for MFA a second time while still keeping MFA required. Which setting should the resource-tenant administrator enable?

Accepted Answer

Correct answer: B. Enabling the inbound Trust setting 'Trust multifactor authentication from Microsoft Entra tenants' in cross-tenant access settings lets the resource tenant's Conditional Access policies accept a guest's home-tenant MFA claim. MFA is still required, but a guest who already completed MFA in their home tenant is not challenged again in the resource tenant.

Question 31

Both the Microsoft traffic profile and the Internet Access profile are enabled and assigned to users running the Global Secure Access client. An administrator opens Microsoft traffic policies and changes the Action for the SharePoint Online policy group (*.sharepoint.com) from Forward to Bypass. What happens to SharePoint Online traffic on those clients?

Accepted Answer

Correct answer: D. Traffic that is available for acquisition in the Microsoft traffic profile can only be acquired in that profile. Setting a rule to Bypass tells Global Secure Access to skip acquisition entirely, so the client uses its normal network routing path to egress directly; the Internet Access profile never inherits that traffic.

Question 32

In Microsoft Entra Internet Access, an administrator builds a custom security profile at priority 100 for the Sales group and also configures the Baseline profile with organization-wide category blocks. A colleague assumes that when the Sales profile matches, the Baseline profile is skipped. Which statement about the Baseline security profile is correct?

Accepted Answer

Correct answer: C. The Baseline security profile is special: it applies to all Internet Access traffic routed through Global Secure Access without needing a Conditional Access link, sits at the lowest priority (65,000), and always executes as a catch-all even when a Conditional Access policy matches another security profile. Priority ordering follows traditional firewall logic, where 100 is highest and 65,000 is lowest, so higher-priority custom profiles are evaluated first and can create exceptions, but the Baseline still runs. This lets you set org-wide protections in Baseline while allowing higher-priority profiles to override specific rules.

Question 33

Quick Access is configured with the wildcard application segment *.contoso.local. An administrator then creates a Global Secure Access enterprise application with an application segment for hr.contoso.local on port 443/TCP and assigns it only to the HR group. A user who is assigned to Quick Access but not to the HR application tries to reach hr.contoso.local. What happens, and why?

Accepted Answer

Correct answer: D. When an enterprise application's network segment overlaps a Quick Access segment, the enterprise application takes precedence for that resource. This enforces explicit per-app assignment, so a user who is not assigned to the HR application is blocked from reaching it even though it falls within the Quick Access wildcard.

Question 34

A company currently uses AD FS with password hash synchronization (PHS) configured through Microsoft Entra Connect. The security team wants to move away from AD FS and adopt pass-through authentication (PTA) instead. Which statement correctly describes a key operational difference between PHS and PTA that the team must plan for?

Accepted Answer

Correct answer: B. With pass-through authentication, user credentials are validated directly against on-premises Active Directory Domain Services in real time via lightweight on-premises agents. No password hash or password is stored in Microsoft Entra ID. With password hash synchronization, a hash of the on-premises password is synchronized to Microsoft Entra ID, allowing authentication to occur in the cloud without any dependency on on-premises infrastructure at sign-in time. This is a critical planning difference: PTA requires on-premises PTA agents to be available for authentication to succeed.

Question 35

After enabling the Microsoft traffic profile, an analyst notices Microsoft Entra sign-in logs now show the security service edge proxy's egress IP instead of each user's real public IP, which breaks IP-based Conditional Access. Which Global Secure Access feature restores the user's actual public egress IP to the sign-in and audit logs?

Accepted Answer

Correct answer: C. Source IP restoration, part of the Adaptive Access feature, detects and securely communicates the user's original public egress IP to Microsoft Entra ID and Microsoft Graph, so IP-based location policies, Identity Protection risk detections, and sign-in/audit logs reflect the real client IP. It requires the Microsoft traffic profile to be enabled.

Question 36

A company wants remote employees to reach an internal server over RDP (3389/TCP) and SSH (22/TCP) with Zero Trust controls and no legacy VPN. They already use Microsoft Entra application proxy to publish a couple of internal web portals. Which approach fits the RDP/SSH requirement?

Accepted Answer

Correct answer: C. Microsoft Entra application proxy publishes HTTP/HTTPS web applications. Arbitrary TCP/UDP protocols such as RDP and SSH are delivered by Microsoft Entra Private Access using application segments (destination, port, and protocol). Both services share the same Microsoft Entra private network connector.

Question 37

A hybrid organization has Microsoft Entra hybrid joined Windows 11 devices and on-premises Active Directory. They want to deploy Windows Hello for Business so users get single sign-on to on-premises file shares, using the simplest deployment with no requirement to deploy or modify a public key infrastructure (PKI). Which trust type should they choose?

Accepted Answer

Correct answer: A. Windows Hello for Business cloud Kerberos trust is the recommended hybrid deployment model. It is the only hybrid option that requires no certificate/PKI deployment; users get a partial TGT from Microsoft Entra ID via Microsoft Entra Kerberos, and on-premises domain controllers still issue Kerberos service tickets for resource access.

Question 38

An administrator enabled Microsoft Entra seamless SSO with password hash synchronization. On corporate, domain-joined Windows devices, users are still prompted for their password in the browser instead of being signed in silently. Sync is healthy and the users are in the correct groups. Which configuration is most likely missing?

Accepted Answer

Correct answer: C. Browsers only send Kerberos tickets to endpoints they trust as intranet sites. Seamless SSO works by having the browser answer the Microsoft Entra sign-in service's HTTP 401 challenge with a Kerberos ticket for the AZUREADSSOACC account, so https://autologon.microsoftazuread-sso.com must be in the users' Local intranet zone, normally delivered via Group Policy. Without that zone entry, silent sign-in fails and the browser falls back to a password prompt. Placing the URL in the Trusted Sites zone instead actually blocks sign-in.

Question 39

Cloud-only users reset their passwords with SSPR successfully, but users synchronized from on-premises AD DS get an error and their on-premises passwords never change. Password hash sync is healthy and all users are licensed for Microsoft Entra ID P1. What must be enabled so the synced users can reset their passwords?

Accepted Answer

Correct answer: D. Password writeback is the feature that writes cloud password changes back to on-premises AD DS in real time, using either Microsoft Entra Connect or Entra Connect cloud sync. Without it, a synchronized user's SSPR cannot commit the new password to AD DS, so the reset fails. Writeback is supported with password hash sync, pass-through authentication, and AD FS.

Question 40

Contoso wants a lightweight hybrid identity option: a cloud-managed, lightweight agent (supporting multiple active agents for automatic failover) that can synchronize users from a disconnected, newly acquired forest, configured entirely from the Microsoft Entra admin center. Which solution best fits?

Accepted Answer

Correct answer: C. Cloud Sync uses lightweight provisioning agents (supporting multiple active agents for automatic failover), is configured and managed in the cloud from the Microsoft Entra admin center, and supports disconnected forests, making it ideal for merger/acquisition scenarios.

Question 41

A network engineer configured a Global Secure Access remote network (a site-to-site IPsec tunnel from the branch's customer premises equipment) so that branch users can reach an internal line-of-business app published through Microsoft Entra Private Access, without installing any client. Users at the branch cannot reach the private app. What is the reason?

Accepted Answer

Correct answer: C. Global Secure Access remote networks support the Microsoft traffic and Internet Access traffic forwarding profiles, but the Private Access profile is not supported over remote network connectivity. Private Access traffic can only be acquired by the Global Secure Access client installed on end-user devices. To give branch users access to a Private Access-published application, deploy the GSA client to those devices rather than relying on the clientless remote-network (IPsec) path.

Question 42

A company is planning a forest consolidation over the next year and will move user accounts between Active Directory domains and forests. They are installing Microsoft Entra Connect now and want the link between each on-premises user and its Microsoft Entra ID object to survive the cross-forest moves. Which attribute should be configured as the source anchor?

Accepted Answer

Correct answer: D. Microsoft recommends ms-DS-ConsistencyGuid as the source anchor whenever objects may move between domains or forests, which is common in consolidations, mergers, and acquisitions. objectGUID is system-assigned and regenerated when an object is recreated in a new domain or forest, which breaks the link to the existing cloud object. Because ms-DS-ConsistencyGuid is a writable attribute, migration tooling can copy the value forward to the target forest so Microsoft Entra ID still hard-matches the moved object to its existing cloud identity. Microsoft's operations guidance is explicit: if you are currently using objectGUID and have cross-forest movement, switch to ms-DS-ConsistencyGuid.

Question 43

An organization with a federated domain wants to pilot cloud authentication (PHS) for one department before converting the whole domain from federated to managed. It needs those pilot users to authenticate directly to Microsoft Entra ID while everyone else in the same domain continues to use AD FS. Which feature accomplishes this?

Accepted Answer

Correct answer: C. Staged rollout is a temporary migration mechanism for federated organizations. Adding users to a staged rollout security group makes Microsoft Entra ID stop redirecting those specific users to the federation server and instead authenticate them directly with cloud authentication (PHS, PTA, or certificate-based authentication) plus optional seamless SSO, while the domain itself remains federated for everyone else. This narrows the blast radius of migration testing: you validate cloud authentication, MFA, and Conditional Access behavior with a pilot group before performing the full domain cutover from federated to managed. Staged rollout is explicitly not intended as a permanent state.

Question 44

An administrator enabled Microsoft Entra Private Access and wants to begin per-app segmentation. They browse to Global Secure Access, then Applications, then Application Discovery, but the discovery table is empty. What is the most likely reason?

Accepted Answer

Correct answer: A. Application Discovery relies on traffic flowing through Quick Access. If Quick Access is not configured, or no users have accessed applications through it, the discovery page shows an expected empty state rather than a product error.

Question 45

An organization deploys Microsoft Entra Private Access as part of Global Secure Access to replace its legacy VPN for remote users. Which statement accurately describes what Microsoft Entra Private Access provides that a traditional VPN does not?

Accepted Answer

Correct answer: C. Microsoft Entra Private Access provides Zero Trust Network Access (ZTNA) at a per-application level, allowing granular Conditional Access policies to be applied to each private resource or app individually. Traditional VPNs grant access to an entire network segment once a user authenticates, which can allow lateral movement. Private Access supports per-app access for TCP and UDP applications, Quick Access for IP and FQDN ranges, and integrates deeply with Conditional Access for more granular security than a VPN provides.

Question 46

You are designing a VerifiedEmployee credential and want to be able to revoke a departed employee's credential later. At issuance time, what must you configure so the credential can be found and revoked afterward, and what is the key limitation?

Accepted Answer

Correct answer: D. Verified ID implements W3C StatusList2021 for revocation. Because Microsoft does not store credential data, the issuer must index exactly one claim (which is salted and hashed) to make credentials searchable. Only one claim can be indexed, and any credentials issued before an index existed cannot be searched or revoked.

Question 47

A Joiner workflow includes the built-in task 'Generate Temporary Access Pass and send via email.' An administrator assumes the TAP is emailed to the new hire. Where is the Temporary Access Pass actually delivered, and what is a prerequisite for the task to work?

Accepted Answer

Correct answer: B. The task 'Generate Temporary Access Pass and send via email to user's manager' generates a TAP and emails it to the new user's manager, who hands it to the employee for first sign-in and passwordless registration. Its prerequisites are a populated manager attribute on the user and a populated mail attribute on that manager. The task uses the employee's hire date as the TAP start time, so the TAP lifetime and the time-of-day on the hire date must be set so the pass is still valid on day one.

Question 48

You want users to automatically receive an access package assignment when their department attribute equals 'Sales' and to lose it when the attribute changes. The access package already has a request policy. Which statement about adding an attribute-based (automatic) assignment policy is correct?

Accepted Answer

Correct answer: A. An access package is limited to a single automatic assignment policy; adding more causes processing issues. Unlike request policies, catalog owners and access package managers cannot create automatic assignment policies - that requires at least the Identity Governance Administrator role.

Question 49

A group access review runs for 10 days with Auto apply results to resource DISABLED. On day 1 a reviewer denies a user and submits all decisions. On day 3 an admin checks the group and the denied user is still a member. Why, and what must happen for the removal to occur?

Accepted Answer

Correct answer: B. Access changes do not take effect until the review reaches its scheduled end date, even if a reviewer completes decisions early. When auto-apply is enabled the system applies decisions shortly after the end date; when it is disabled, an administrator must manually apply the results after the review completes.

Question 50

In PIM you create an access review of the Security Administrator Microsoft Entra role. You want reviewers to attest only to users who can elevate into the role via just-in-time access, and you want to exclude anyone who holds the role as a standing (permanent/active) assignment. Which setting achieves this?

Accepted Answer

Correct answer: C. When creating a PIM role access review, the Assignment type scope lets you review 'eligible assignments only' (principals who can activate the role, regardless of current activation status), 'active assignments only', or 'all active and eligible assignments'. Choosing eligible assignments only reviews the just-in-time-capable users and excludes standing active assignments.

Question 51

You enable 'Require approval to activate' on the Global Administrator role in PIM but do not specify any approvers. All Global Administrators and Privileged Role Administrators currently hold eligible (not active) assignments. What is the risk?

Accepted Answer

Correct answer: C. When approval is required but no approvers are configured, the default approvers are the active Privileged Role Administrators/Global Administrators. If all of them are only eligible and none are active, there is no one to approve activations, which can lock you out of the tenant. Microsoft recommends configuring specific approvers and maintaining emergency access (break-glass) accounts.

Question 52

Two access packages, 'Western Territory' and 'Eastern Territory,' grant mutually exclusive sales-territory app roles, and a user should never hold both. An administrator opens the Western Territory package's Separation of duties settings and adds Eastern Territory to its Incompatible access packages list. Testing shows a user who already has Eastern Territory is blocked from requesting Western Territory, but a user who already has Western Territory can still request Eastern Territory. What is the cause and fix?

Accepted Answer

Correct answer: D. A separation-of-duties incompatible-access-package relationship is unidirectional. Marking Eastern Territory as incompatible on the Western Territory package only prevents users who already have Eastern Territory from requesting Western Territory. To block the reverse direction, where a user who already holds Western Territory requests Eastern Territory, you must also open the Eastern Territory package and add Western Territory to its incompatible list. Microsoft's documentation calls this out explicitly with the Western/Eastern territory example.

Question 53

A catalog owner is building a new access package in the Marketing catalog. They want to include a specific SharePoint Online site and a security group, but neither resource appears in the picker while they are creating the access package. Both resources exist in the tenant. What step did they miss?

Accepted Answer

Correct answer: C. Access packages reside in catalogs, and a catalog is a container of resources and access packages. The required order is: first add the resources (groups, applications, SharePoint sites) to the catalog, and then add those catalog resources to an access package. Resources that have not yet been added to the catalog do not appear in the access package's resource picker, which is exactly the symptom described.

Question 54

You want a recurring group membership review that surfaces only members who haven't signed in (interactively or non-interactively) to the tenant for a long time, and you want to define that inactivity window. In the Users scope you check Inactive users (on tenant level) and set Days inactive. What is the maximum value, and what happens to very new accounts?

Accepted Answer

Correct answer: B. When scoping a review to inactive users at the tenant level, Days inactive can be set up to 730 days (two years). Recently created users who haven't existed for at least the configured window are disregarded, ensuring a user can sign in at least once before becoming eligible for removal.

Question 55

An Identity Governance Administrator creates an access package in a catalog for an application. An internal user requests access. The policy is configured with Manager as the first approver and a fallback approver, with a 14-day request window. On day 7, neither the manager nor the fallback approver has responded. What happens to the request if alternate approvers are NOT configured?

Accepted Answer

Correct answer: B. In Microsoft Entra Entitlement Management, if no approver approves or denies a request within the configured approval period, the request automatically expires and is denied. The user must submit a new request. Alternate approvers can be configured to receive the request after a specified number of days if the primary approvers have not acted, but forwarding to alternate approvers can only begin after the request reaches its half-life (day 7 in a 14-day window) and requires at least a 4-day timeout. Without alternate approvers configured, the request simply expires at day 14 without approval.

Question 56

An administrator onboards the security group 'DBA-Access' to PIM for Groups and, on the group's membership activation policy, sets 'Require approval to activate.' Eligible members are correctly prompted for approval. However, a user who is an eligible OWNER of the group activates ownership and is never prompted for approval. Assuming the configuration is otherwise correct, what explains this?

Accepted Answer

Correct answer: A. In PIM for Groups, every onboarded group has two independent policies: one governing activation of membership and one governing activation of ownership. Settings such as require-approval, MFA, and maximum activation duration are configured per policy. Setting 'Require approval to activate' on the membership policy does not affect ownership activation; the ownership policy must be configured separately to require approval for owners.

Question 57

You create an access review for a group with 'Auto apply results to resource' enabled and 'If reviewers don't respond' set to 'Take recommendations'. The assigned reviewer goes on leave and makes no decisions. What happens to group members when the review ends?

Accepted Answer

Correct answer: D. With auto-apply enabled and the no-response action set to 'Take recommendations', unreviewed users automatically get the system recommendation. Recommendations deny users inactive for 30+ days, so those users are removed. Microsoft explicitly warns this combination can revoke access broadly if reviewers fail to respond.

Question 58

Your organization is standing up Microsoft Entra Verified ID to issue employee credentials. During setup you must choose the trust system that resolves decentralized identifiers (DIDs) so a wallet can look up the issuer's public keys and confirm domain ownership. Which trust system is currently supported and generally available in Microsoft Entra Verified ID?

Accepted Answer

Correct answer: B. Verified ID currently supports the did:web trust system, which is generally available. did:web is a permission-based model that anchors trust in a web domain's existing reputation: the DID document is hosted under the organization's own DNS domain, so wallets resolve the issuer's public keys and validate linked-domain ownership from there.

Question 59

A security analyst monitoring Privileged Identity Management notices that a colleague was granted the Global Administrator role directly through the Microsoft Entra roles blade rather than through a PIM eligible assignment. Which PIM security alert is raised for this, and at what severity?

Accepted Answer

Correct answer: C. PIM raises the 'Roles are being assigned outside of Privileged Identity Management' alert, at High severity, when a privileged role assignment is created directly through the roles blade, Azure IAM, or the API rather than through PIM. Microsoft rates it High because assignments made outside PIM are not properly monitored and might indicate an active attack; the in-portal mitigation removes the user from the privileged role.

Question 60

An access package uses a policy For users not in your directory scoped to a connected organization (partner Contoso). You want the partner's own point of contact - a Contoso employee you previously invited as a B2B guest into your tenant - to approve incoming requests from Contoso users. Which approver type do you select?

Accepted Answer

Correct answer: A. External sponsors are guest users from the connected organization who are already in your directory; internal sponsors are member (internal) users of your directory. For requests from external users, the partner's B2B guest contact is the external sponsor and can be designated as the approver.

Question 61

A developer wants to control which in-app features a user can access and receive that assignment in the token so the app can enforce it in code. They're deciding among Azure RBAC, Microsoft Entra directory roles, and app roles. Which should they use, and why?

Accepted Answer

Correct answer: A. Application-specific authorization is implemented with app roles: the developer defines roles in the app registration, admins assign users/groups to them, and the assignments are emitted in the token's roles claim for the app's code to evaluate. This is distinct from Azure RBAC (governs Azure Resource Manager resources) and Microsoft Entra RBAC (governs directory resources).

Question 62

To restrict several single-tenant service principals from authenticating outside the corporate IP ranges, an administrator adds those service principals to a security group and targets a Conditional Access for workload identities policy at the group. Testing shows the policy is not enforced for the service principals. What is the correct explanation and fix?

Accepted Answer

Correct answer: A. Conditional Access for workload identities does not honor group membership: although a service principal can be added to a group, a policy assigned to a group that contains a service principal is not enforced for that service principal. To enforce the policy, the service principals must be selected and assigned directly as workload identities in the policy. (The feature also only covers single-tenant service principals registered in your tenant and requires Workload Identities Premium.)

Question 63

You change User consent settings to 'Allow user consent for apps from verified publishers, for selected permissions.' Afterward, users can't consent to any application, even a verified-publisher app that requests only Microsoft Graph User.Read. What is the most likely cause?

Accepted Answer

Correct answer: C. The 'verified publishers, for selected permissions' option (microsoft-user-default-low) lets users consent only to permissions you explicitly classify as low impact under Permission classifications. If you haven't classified any permissions, the set of user-consentable permissions is empty, so users can't consent to anything, even User.Read.

Question 64

A GitHub Actions pipeline that runs on GitHub-hosted runners deploys resources to Azure. It currently authenticates using a client secret stored as a GitHub repository secret. The security team wants to eliminate the stored secret entirely while keeping the same app registration and its permissions. Which approach should they implement?

Accepted Answer

Correct answer: C. Workload identity federation lets you configure a federated identity credential on the app registration that trusts tokens issued by an external identity provider such as GitHub. The GitHub Actions workflow presents its OIDC token; Microsoft Entra validates it against the credential (issuer, subject, and audience must match, case-sensitively) and returns an access token. No secret is stored anywhere, and the existing app registration and its granted permissions are reused.

SC-300 practice questions, with full explanations

Entra ID Fundamentals (15 questions)