Visit here for our full Microsoft MS-102 exam dumps and practice test questions.
Question 91:
Your organization recently acquired a subsidiary and needs to integrate their existing identities into Microsoft 365. The subsidiary uses unmanaged accounts created with personal emails using the same domain as the parent company. Users must be moved into the organization’s managed tenant without losing access to their existing OneDrive, emails, or Teams chats. The organization wants a method that ensures data ownership transfers to the organization securely while preventing disruptions for daily operations. What should you implement?
A) Use the Entra ID cross-tenant synchronization feature
B) Convert unmanaged accounts into managed accounts using the Microsoft 365 domain takeover process
C) Create new accounts in the managed tenant and migrate mailbox data only
D) Use AD Connect to synchronize identities from the subsidiary into the cloud
Answer:
B)
Explanation:
When dealing with a merger or acquisition scenario in Microsoft 365, identity consolidation is one of the most complex and sensitive components of the integration process. In this scenario, the subsidiary’s users are currently using unmanaged accounts with personal Microsoft identities under the same domain that the primary organization controls or intends to control. These unmanaged accounts exist as consumer Microsoft accounts, also referred to as personal accounts, even though they use corporate email addresses. This situation commonly arises when an organization had not previously claimed or verified ownership of their domain in Azure Active Directory before users began registering Microsoft consumer services individually.
The organization’s goal is to bring these unmanaged identities under centralized IT control while ensuring that the users retain access to all Microsoft 365 content tied to those accounts. This includes OneDrive files, Exchange Online mail, Teams chats, organizational resources, and any associated licenses or app settings. The challenge is that unmanaged identities do not exist inside the organization’s tenant, meaning the central IT department currently has no administrative authority or policy controls over them. When dealing with this type of environment, Microsoft offers a formalized process known as the Microsoft 365 domain takeover procedure, which converts consumer accounts associated with a corporate domain into fully managed organizational accounts.
The domain takeover process includes two variations: an administrative takeover or an internal takeover. The administrative takeover is designed for situations where the organization has rightful ownership of a domain but users have previously signed up individually for Microsoft consumer services. As part of the takeover procedure, administrators verify ownership of the domain by adding DNS records. Once verified, Microsoft recognizes the organization’s right to manage all identities and resources associated with that domain. As a result, the unmanaged consumer accounts must be transitioned into the organization’s Microsoft Entra tenant.
During this conversion, each user is prompted to accept the migration of their personal Microsoft account into its new form as an organizational account. This process ensures that data associated with those accounts transitions into the organization’s controlled tenant environment. Importantly for this scenario, the takeover process allows continuity of access to OneDrive content, Teams messages, and email resources. Users authenticate after the conversion using organizational credentials, but their data flows seamlessly into the new identity context.
Option A suggests cross-tenant synchronization, which is a feature used for synchronizing identities between two Azure AD tenants. While cross-tenant synchronization is beneficial for collaborative environments or migrations where both tenants remain operational, it does not convert unmanaged or personal Microsoft accounts into managed accounts. It also does not fix issues related to data ownership, domain conflicts, or compliance gaps that exist when personal accounts are used with corporate data. Therefore, this option does not meet the requirements.
Option C proposes creating new accounts in the managed tenant and migrating mailbox data only. While this approach is sometimes used during tenant-to-tenant migrations, it does not satisfy the scenario requirement of preserving access to OneDrive and Teams content. Migrating mailboxes addresses only Exchange data, leaving all other workloads disconnected. Additionally, creating totally new accounts disrupts user workflows and inevitably leads to loss of data unless complex and expensive third-party tools are used. The organization specifically wants a secure and non-disruptive method, so this method is not suitable.
Option D proposes using Azure AD Connect to synchronize identities from the subsidiary into the cloud. However, Azure AD Connect only synchronizes accounts from an on-premises Active Directory environment. Because the subsidiary is using unmanaged personal Microsoft accounts, they are not tied to local Active Directory and cannot be synchronized. Azure AD Connect does not convert consumer accounts, does not handle domain conflicts, and cannot claim domain ownership. Therefore, it cannot meet the stated objectives.
The domain takeover process is widely used in acquisition scenarios because it ensures that identities and data can be transitioned into a fully managed Microsoft 365 environment without disruption. Once the takeover is complete, the organization gains full administrative control over security policies, conditional access, data loss prevention, and lifecycle governance. This directly aligns with MS-102 exam emphasis on identity consolidation, tenant governance, and cross-organizational identity controls. The takeover process ensures the organization enforces security baselines across all identities now brought under corporate management, enabling future compliance readiness and risk reduction. Therefore, option B is the only method that matches every aspect of the requirement in this scenario.
Question 92:
An enterprise wants to implement a stricter conditional access framework that evaluates risk levels in real time. They want policies that automatically challenge users with multi-factor authentication during risky sign-ins, block access for high-risk sign-ins, and trigger automated remediation such as password reset when a user’s overall risk score increases. The solution must integrate identity signals from Microsoft Defender and take advantage of machine-learning-based risk detection. Which configuration should you deploy?
A) Conditional access baseline policies in Entra ID
B) Identity Protection risk-based conditional access policies
C) Named locations combined with sign-in risk filters
D) MFA registration policies only
Answer:
B)
Explanation:
This scenario describes the need for dynamic, risk-aware, machine-learning-driven access control within Microsoft 365, something that the MS-102 exam emphasizes as a critical component of modern identity security. The organization wants a system that evaluates user sign-ins based on risk indicators, integrates with Microsoft Defender for threat intelligence, and applies automated remediation workflows such as enforcing password resets. These requirements align directly with Microsoft Entra ID Identity Protection, a feature that provides risk-based conditional access driven by real-time analytics.
Identity Protection is designed to detect anomalies and suspicious behaviors, such as impossible travel patterns, unfamiliar locations, atypical device usage, malware-associated IP addresses, or leaked credentials. It uses Microsoft’s global security intelligence sources, along with signals from Microsoft Defender, to compute risk classifications. These risk classifications occur at two levels: user risk and sign-in risk. User risk refers to the probability that the user’s account has been compromised, while sign-in risk evaluates whether a specific authentication attempt is risky. The organization wants the ability to challenge users with MFA when sign-in risk is detected, block high-risk sign-ins, and automatically force password resets when user risk increases. Identity Protection offers built-in policy templates that allow exactly this workflow.
The risk-based conditional access policies in Identity Protection work by evaluating each authentication event against machine-learning-based risk assessments. For instance, if a user logs in from an IP associated with malicious activity or demonstrates behavior inconsistent with their usual login patterns, Identity Protection can evaluate the sign-in risk as medium or high. Depending on the policy configuration, the system can require MFA or block access entirely. The exam highlights that risk-based access control allows organizations to implement policies tailored to behavioral analytics rather than static rules. Static rules, such as named locations or network-based restrictions, cannot dynamically adjust to new risks. Given that threat vectors evolve, dynamic detection is vital.
Option A refers to baseline conditional access policies, which were older global policies providing basic protections like MFA for admins. These baseline policies have been deprecated and replaced with security defaults. Baseline policies do not integrate with machine-learning-driven risk detection nor offer automated remediation workflows. Therefore, they are insufficient for the scenario.
Option C involves named locations combined with sign-in risk filters. Named locations are useful for defining trusted networks or blocking specific regions. While sign-in risk filters can be applied, this combination does not cover user risk remediation workflows such as forcing password resets. It also does not leverage full Identity Protection capabilities, such as integration with Defender signals and continuous monitoring. Named locations are static, whereas the scenario requires real-time adaptive risk analysis.
Option D refers to MFA registration policies, which ensure users enroll MFA authentication methods but do not assess risk or apply dynamic remediation. MFA registration is a foundational requirement but not a substitute for risk-aware conditional access.
Identity Protection, in contrast, evaluates sign-in behavior continuously and provides remediation actions automatically when risk increases. These remediation actions include challenging with MFA, blocking access, or requiring password reset. Integration with Microsoft Defender is built into the risk engine, meaning the organization benefits from global threat intelligence. This capability is explicitly highlighted across MS-102 study pathways, where candidates must demonstrate an understanding of automation in identity threat detection and response.
In a real-world environment, Identity Protection policies enhance Zero Trust architecture by ensuring authentication is not simply granted based on credentials but evaluated through context and risk. Zero Trust emphasizes verifying explicitly and analyzing risk before granting access. Identity Protection is one of the primary systems enabling this model within Microsoft 365.
Therefore, the correct choice is Identity Protection risk-based conditional access policies.
Question 93:
A company wants to simplify application access for users by implementing a centralized application portal where employees can access SaaS apps, internal line-of-business tools, and integrated enterprise systems. They want automatic provisioning and deprovisioning of user accounts in third-party applications based on group membership and role changes. Additionally, they want lifecycle governance that prevents orphaned accounts in external apps. Which configuration should be deployed?
A) Use Microsoft MyApps portal without SCIM provisioning
B) Deploy Entra ID Enterprise Applications with automatic SCIM provisioning
C) Configure SSO using password-based authentication only
D) Set up app launcher bookmarks inside Microsoft 365 admin center
Answer:
B)
Explanation:
The scenario describes a need for a centralized application portal, automated account provisioning, lifecycle governance, and support for third-party systems. Microsoft Entra ID Enterprise Applications combined with SCIM provisioning directly aligns with these requirements. The MS-102 exam frequently tests understanding of application integration in Microsoft 365 environments, specifically emphasizing the ability to integrate SaaS products, configure provisioning, and enforce lifecycle management controls.
System for Cross-Domain Identity Management (SCIM) is an industry-standard protocol designed for automating user identity lifecycle processes. When SCIM provisioning is enabled in Entra ID, user accounts within third-party systems are created, updated, and removed based on changes inside the Microsoft 365 environment. For example, if a user joins a department and is assigned to a security group linked to an application, Entra ID will automatically create an account in the target system and assign the appropriate role. Conversely, if a user leaves the company or changes departments, their external application accounts are updated or removed automatically. This reduces the likelihood of orphaned accounts, which are accounts that remain active in external systems even after the user should no longer have access.
SCIM provisioning works seamlessly with the Entra ID MyApps application portal, giving users a single unified location where they can locate all assigned apps. The portal displays enterprise applications, SaaS integrations, and internal apps. Admins can control which apps appear based on security group assignments. This creates a personalized experience for users while maintaining centralized visibility for IT teams.
Option A proposes using the MyApps portal without SCIM provisioning. Although the MyApps portal does provide a central app location for end users, without SCIM provisioning it cannot manage account lifecycle in external applications. Users might still accumulate orphan accounts in SaaS apps or retain access after departing a department. This fails to meet the requirement of automatic provisioning and secure lifecycle governance.
Option C, SSO using password-based authentication, is a simple approach to enable single sign-on for apps that do not support federation. However, it offers no account lifecycle automation. Password-based SSO only stores and injects credentials but does not integrate with provisioning workflows. This fails to reduce administrative work or improve security in relation to lifecycle management.
Option D suggests using bookmarks within the Microsoft 365 admin center. Bookmarks do not provide any identity lifecycle features, provisioning workflows, or user-to-app assignment controls. They serve only as convenient shortcuts.
Enterprise Applications with SCIM provisioning meets every requirement: centralized app discovery, lifecycle governance, automatic provisioning, deprovisioning, and integration across various SaaS platforms. This approach also aligns with Zero Trust principles by ensuring access to applications is based on real-time directory information, not static manual administration.
Question 94:
A Microsoft 365 administrator needs to configure a cross-tenant mailbox migration from the company’s old Microsoft 365 tenant to a newly created production tenant. The goal is to move user mailboxes with minimal downtime, ensure secure migration, validate identity mapping, and maintain audit trail accuracy. Which component must be established first to allow the new production tenant to recognize the source tenant’s directory objects?
A) Configure a cross-tenant trust relationship with organizational settings and enable multi-step migration
B) Enable hybrid coexistence with Azure AD Connect Cloud Sync before creating migration batches
C) Activate automatic mailbox forwarding between tenants and convert users to shared mailboxes temporarily
D) Use eDiscovery export keys to transfer identity metadata before initiating migration endpoints
Answer:
A)
Explanation:
The process of cross-tenant mailbox migration within Microsoft 365 is becoming increasingly important, especially for organizations undergoing restructuring, mergers, acquisitions, or domain-to-domain consolidation. In earlier years, organizations had to rely on third-party tools or recreate accounts manually when migrating mailboxes between Microsoft 365 tenants because native mailbox migration paths were limited. However, Microsoft introduced the capability for cross-tenant mailbox migrations, which rely heavily on permissions, trust, and identity validation between source and target tenants. The essential starting point, before any mailbox migration batch can even be created, is establishing a cross-tenant trust relationship with clearly defined organizational settings. Without this, the target tenant has no awareness of the source tenant’s directory objects and cannot authenticate or authorize the mailbox move.
The identity objects being referenced here include user GUIDs, mailbox IDs, Azure AD object identifiers, and other backend elements that Microsoft 365 uses to manage secure routing, authorization, and mailbox movement. When organizations start planning such migrations, they often assume that simply creating migration endpoints or synchronizing directories is enough, but the mechanics of cross-tenant mailbox movement require clarity of identity provenance. The target tenant must confirm that the source tenant agrees to the activity and that both sides can trust each other’s tokens and permissions. This is where the cross-tenant trust configuration takes place.
This trust is not simply a checkbox option. It involves configuring cross-tenant access settings within Entra ID, specifically under External Identities. The administrator must define inbound and outbound policies that govern which users, groups, applications, and permissions may be recognized across tenants. Microsoft utilizes these trust policies to validate migration intent, identity authenticity, and permission reliability. Without this trust in place, the migration endpoint will fail because the target tenant cannot map or authorize object-level migrations from a separate tenant.
Once this trust is configured, multi-step migration can be enabled. This feature allows administrators to migrate mailbox data in stages: an initial synchronization, incremental delta syncs, and then a final switchover. This minimizes downtime because users can continue working on the source tenant while most data is being copied. Only during the final cutover is downtime noticeable, and even then, it is extremely brief. The trust relationship makes it possible for the target tenant to authenticate mailbox move requests, verify user identities, and maintain accuracy of audit trails through the entire movement.
Option B might appear relevant because many administrators are familiar with hybrid migration models using Azure AD Connect Cloud Sync or traditional Azure AD Connect synchronization. However, directory synchronization is used primarily for hybrid on-premises-to-cloud migrations, not cloud-to-cloud tenant migrations. In tenant-to-tenant scenarios, both directories are already in Microsoft Entra ID, so there is no need for synchronization infrastructure like AAD Connect. Additionally, cross-tenant mailbox migrations do not require domain controllers or hybrid connectivity.
Option C reflects a workaround organizations used many years ago before native capabilities existed. Administrators would sometimes forward mail automatically or convert users to shared mailboxes to preserve content, but these approaches are no longer necessary and do not address the identity verification requirements of modern Microsoft 365 migrations. Temporary conversions add administrative overhead and can cause license loss or disruption to mailbox quotas. More importantly, this method never creates the essential trust relationship Microsoft 365 now mandates.
Option D involves eDiscovery export keys, which relate to exporting mailbox content for legal or compliance purposes. These processes are unrelated to identity mapping, user object structure, or permission delegation required for mailbox moves. eDiscovery exports create PST files or structured datasets but play no role in preparing a target tenant for recognizing source objects.
By establishing the trust relationship first, administrators enable the secure pipeline Microsoft expects before mailbox migration. This includes defining which users are allowed to migrate, what mailbox data can flow, and whether administrators in one tenant can execute tasks on behalf of another tenant. The trust relationship also supports secure token exchange, ensuring no unauthorized migration occurs. Many organizations overlook the importance of outbound migration consent; the source tenant must explicitly approve migration for each mailbox, preventing accidental or malicious movement.
Cross-tenant trust is also integral for maintaining correct audit trails. Microsoft 365 automatically logs mailbox access, migration events, administrative actions, and data movement. To ensure that these logs preserve identity attribution accurately, the system must know how to interpret actions performed across tenant boundaries. Without trust configured, audit data could be incomplete, misleading, or inaccessible.
Another important aspect is identity matching. When a mailbox is moved from one tenant to another, the identity on the target side must correspond to the source identity. Administrators typically pre-provision user accounts in the target tenant or utilize scripted provisioning with GUID mapping. This requires the trust to be active so that the target tenant can validate the mapping, preventing mismatches that could lead to mail routing issues or inconsistent access rights after migration.
Once the trust relationship is configured with appropriate settings, administrators can proceed to create migration endpoints, run pre-move checks, analyze potential errors, and prepare staged migration batches. The actual migration process then becomes much more predictable and secure. Trust effectively functions as the foundation that supports all subsequent migration steps. Without it, nothing related to cross-tenant mailbox movement can take place.
Therefore, the correct answer is A, as configuring the cross-tenant trust relationship with organizational settings and enabling multi-step migration is the foundational piece that unlocks the rest of the process.
Question 95:
An administrator is assigned the task of blocking unmanaged personal devices from accessing Microsoft 365 resources while still allowing approved corporate laptops, phones, and virtual machines to connect. The organization uses Entra ID joined devices and utilizes Microsoft Intune for device compliance. Which method provides the most reliable enforcement mechanism for controlling access?
A) Configure Conditional Access with device filters and require compliant or hybrid-joined devices
B) Apply mail flow rules that block ActiveSync traffic from devices lacking a registered device ID
C) Disable all mobile access permissions in the Exchange admin center and whitelist known IP addresses
D) Implement Azure Firewall rules to restrict inbound traffic only from corporate-managed networks
Answer:
A)
Explanation:
The challenge of controlling which devices can or cannot access Microsoft 365 services is a central theme within the MS-102 exam. Administrators are expected to understand device compliance, conditional access, identity trust signals, continuous monitoring, and integration between Microsoft Intune and Microsoft Entra ID. The scenario describes an organization aiming to restrict unmanaged devices from accessing any corporate resources while providing seamless access to approved corporate laptops, smartphones, and virtual machines. This requires identity-aware device-based evaluation, something Conditional Access can uniquely achieve.
Conditional Access provides adaptive access control embedded directly into Microsoft Entra ID’s authentication pipeline. It evaluates sign-in attempts based on many signals including user identity, device state, location, authentication strength, risk level, and compliance result. It is also the only mechanism capable of enforcing policies across all Microsoft 365 applications consistently. When paired with Intune’s compliance engine, Conditional Access can determine whether a device is compliant, noncompliant, hybrid-joined, Entra ID joined, or unmanaged. Administrators can then implement a rule requiring a device to be both registered and compliant with organizational standards to access Microsoft 365.
Device filters within Conditional Access allow even more granular control. These filters can differentiate between device types, ownership levels, operating systems, model identifiers, and join types. For example, an administrator may design a policy that grants access only to Entra ID joined devices enrolled in Intune, while blocking devices marked as personal or not enrolled. This directly aligns with the scenario: corporate devices are enrolled and meet compliance policies, while personal devices are not enrolled and therefore are blocked.
Option B is far too narrow and outdated. Mail flow rules in Exchange Online can block ActiveSync traffic, but modern organizations access Microsoft 365 through many channels such as browser sessions, desktop apps, and modern authentication APIs. Blocking ActiveSync would stop only a subset of legacy mobile device connections. Additionally, relying on device ID presence in ActiveSync headers is not a reliable method and does not protect SharePoint, Teams, or other Microsoft 365 workloads.
Option C suggests disabling mobile access permissions in the Exchange admin center. This method affects only email services and leaves SharePoint, Teams, and other cloud applications unprotected. Whitelisting IPs is also not effective because personal devices may connect through approved corporate networks or VPNs, bypassing the intended restriction. IP-based security is considered outdated and insufficient in a zero-trust architecture.
Option D, while addressing network-layer filtering, does not handle modern cloud identity. Microsoft 365 is accessed via the internet and not hosted behind a firewall under the administrator’s full control. Azure Firewall rules might restrict inbound corporate traffic for specific workloads, but they cannot control how users authenticate to Microsoft 365. Microsoft designed the platform such that identity, not IP origin, determines access rights. Cloud apps evaluate authentication through token-based systems, and Conditional Access remains the mechanism MS-102 focuses on for device-based enforcement.
Conditional Access also integrates with compliance policies to ensure corporate devices meet organizational requirements such as encryption, antivirus updates, OS version levels, secure startup, and more. When a device becomes noncompliant, Conditional Access blocks access immediately, preserving strong security posture. This continuous enforcement is essential in scenarios where laptops or phones may drift into noncompliant states.
Conditional Access also supports device state evaluation at the token issuance stage. That means users cannot obtain access tokens at all unless their device meets the compliance requirements. This eliminates the risk that a user might get a token on a personal device and retain access for hours regardless of future policy changes. Instead, Conditional Access ensures each authentication event is evaluated in real time.
Another advantage is that administrators can apply different tiers of protection. They may allow certain corporate applications to be accessed from unmanaged devices if the user passes MFA, while requiring full compliance for sensitive apps like Exchange Online or SharePoint Admin Center. The flexibility helps organizations adopt granular access models without fully locking down access in all scenarios. However, for the scenario described, requiring compliant devices is the strongest safeguard.
Intune device compliance works hand-in-hand with Conditional Access. When a device enrolls, Intune determines compliance status based on multiple conditions defined by the administrator. These may include OS version restrictions, encryption requirements, password rules, threat protection integration, and more. Intune then sends this compliance state to Entra ID. Conditional Access checks this signal when evaluating whether to allow or deny access. This integration forms the backbone of zero-trust device-based access.
By configuring device filters, administrators can even restrict access to specific device models or deny access to devices classified as personal. For example, you can filter for device ownership attributes or distinguish Windows virtual machines from physical devices.
This integration across Entra ID and Intune ensures the organization can achieve the goal stated: allowing only approved corporate-managed devices to access Microsoft 365 resources while blocking unmanaged personal devices across all services.
Thus, Option A is the correct solution.
Question 96:
An organization using Microsoft 365 notices that several external sharing links from SharePoint Online are being forwarded outside the intended recipients, allowing unintended users to access sensitive internal documents. The company wants to maintain external collaboration but enforce stricter access control. What approach provides the best balance of security and usability?
A) Configure SharePoint Online external sharing to require guest accounts with authentication and disable anonymous sharing
B) Disable external sharing globally for SharePoint and allow file exports only via manually approved channels
C) Enforce automatic watermarking and read-only browser restrictions for all shared content
D) Block all external domains except those explicitly added to an allow list, preventing unauthorized recipients
Answer:
A)
Explanation:
External sharing is one of the most carefully tested areas in the MS-102 exam because it ties identity governance, access control, and collaboration management together. Organizations today rely on external sharing for business partners, suppliers, customers, and contractors. Completely disabling it is rarely an option. Instead, administrators must balance collaboration needs with the necessity of protecting sensitive data, preventing unauthorized forwarding, and ensuring that only authenticated external users can access the shared content.
In the problem scenario, external sharing links have been forwarded outside intended recipients. This indicates that the organization is using anonymous links or overly permissive external link settings that do not require the recipient to authenticate. Anonymous links are inherently risky because anyone who obtains the link—through forwarding, accidental exposure, or phishing—can access the file. This clearly violates the organization’s need for stricter control while maintaining collaboration.
The correct approach is to require authentication for external users by forcing guest accounts. When SharePoint Online restricts sharing to authenticated external users only, it ensures that every recipient must sign in using a verified identity. Administrators also gain full audit traceability: they can see which guest accessed what document, at what time, and from which device. This accountability eliminates the risks associated with anonymous access.
Microsoft offers several levels of external sharing:
Anonymous links
• New and existing guests
• Existing guests only
• Only people in your organization
By choosing to require guests, the organization can still collaborate externally but as part of a controlled identity group. Guest accounts are governed under Microsoft Entra External Identities, which allows administrators to enforce MFA, Conditional Access, guest lifetime policies, sign-in risk evaluation, and much more.
Option B suggests disabling external sharing globally, which contradicts the requirement to maintain collaboration. While some highly regulated industries disable external sharing entirely, most organizations require a more flexible approach. Manual file transfer channels inconvenience users and often drive them toward shadow IT solutions.
Option C, applying watermarking and read-only browser access restrictions, may add protection but does not address the fundamental issue of unauthorized recipients. Watermarks discourage misuse but do not prevent someone other than the intended user from opening the link. Read-only mode restricts editing but still does not enforce authentication. These features complement secure external sharing but cannot replace mandatory identity requirements.
Option D restricts external domains, which may be beneficial if the organization collaborates only with a set group of partners. However, this method still does not prevent link forwarding within approved domains. Moreover, this approach assumes that guests always use corporate domains, which is often not the case. Many partners use personal email accounts or contractors. Domain restrictions can slow productivity and frustrate legitimate external users.
The scenario specifically requires preventing forwarded access. Only authenticated access ensures the link works exclusively for the intended person. SharePoint supports one-time passcodes for individuals without Microsoft accounts, simplifying access while enforcing authentication. Administrators can also specify expiration dates for external access, restrict permissions, and require review of access on a schedule.
Enforcing guest-based authenticated access also supports downstream compliance frameworks such as sensitivity labels, data loss prevention policies, insider risk monitoring, and conditional access for guests. It offers a holistic protection approach rather than simply restricting files.
By enabling guest account authentication and disabling anonymous links, the organization strikes the right balance: external collaboration continues, but only trusted and authenticated identities gain access.
Thus, Option A is the correct solution.
Question 97:
A global organization wants to strengthen protection of Microsoft 365 administrative roles because several privileged users travel frequently and sometimes sign in from unfamiliar locations. The company already uses MFA but wants an additional layer of control that evaluates unusual sign-in patterns, device signals, user behavior, and real-time access attempts. Which approach provides the strongest protection?
A) Use Entra ID Identity Protection risk-based Conditional Access policies for sign-in and user risk evaluation
B) Enable password expiration for administrators and require password change every 30 days
C) Assign all administrators to separate admin-only workstations without internet browsing
D) Configure Azure Firewall policies to restrict administrator portal access to fixed trusted IP ranges
Answer:
A)
Explanation:
Risk-based Conditional Access offered through Microsoft Entra ID Identity Protection has become one of the most powerful tools for organizations seeking to secure privileged identities without introducing friction that slows productivity. In this scenario, administrators travel often, and their sign-in patterns naturally change depending on airports, hotels, partner offices, and regional ISP routes. Traditional firewall-based control such as IP whitelisting becomes impractical because travel makes administrators’ IP addresses unpredictable. At the same time, simply relying on MFA is not enough because threat actors can still attempt phishing attacks, token replay, man-in-the-middle attacks, or device-based compromise. Identity Protection fills this exact gap by providing real-time analysis using Microsoft’s intelligence graph. This graph correlates billions of signals across Microsoft cloud services, global threat intelligence feeds, atypical activity triggers, device posture indicators, and user-based anomaly detection.
When administrators authenticate, Identity Protection checks for indicators such as impossible travel, TOR exit nodes, unfamiliar sign-in locations, suspicious IP reputation, malware-linked addresses, unusual device configuration, leaked credential signals, and sign-in patterns that deviate from historical norms. This is especially effective for administrators because they are targeted more aggressively than standard users. The system then calculates sign-in risk and user risk. Sign-in risk is evaluated during each authentication attempt, while user risk reflects underlying compromise probability of the identity itself. Conditional Access policies can block high-risk attempts, require stronger authentication, require password reset, or deny access completely. Unlike static controls, risk evaluation adapts to each session, meaning it responds to real-time behavior rather than relying on preset lists.
Option B proposes password expiration, an outdated model that contradicts modern security guidance. Forcing frequent password changes leads users to create weaker, predictable patterns. It also does not prevent attackers using stolen tokens or compromised sessions. Password rotation cannot react to real-time risk signals like unusual location or risky IP sources.
Option C suggests issuing admin-only workstations. While using dedicated secure workstations for administrative tasks is a recommended best practice for privileged accounts, it does not address the scenario’s specific challenge involving unpredictable travel. A secure workstation does not evaluate abnormal geographic behavior or prevent unauthorized sign-ins from untrusted networks if credentials are compromised. It is a helpful control, but incomplete without risk-based evaluation.
Option D attempts to restrict access by IP ranges, but this conflicts with the company’s reality that administrators travel frequently. Their IP addresses change constantly, making IP-based restrictions impractical. Additionally, IP-based security does not detect compromised credentials used from a previously trusted address.
Identity Protection evaluates signals in real time, reducing the chance of unauthorized access regardless of location or device. It integrates deeply with Microsoft 365 services. Because this is an advanced cloud-native solution, it is built for dynamic environments, making it ideal for organizations with mobile administrators. For these reasons, Option A is the most effective approach.
Question 98:
A company preparing for an internal audit discovers that several Microsoft 365 groups have external guests who still have access to SharePoint sites and Teams channels despite not having collaborated with the organization for months. The company wants a continuous mechanism that automatically reviews guest lifecycle, enforces access recertification, and removes inactive or unnecessary guests. Which feature best addresses this requirement?
A) Use Entra ID Access Reviews for groups and applications, with recurring review cycles
B) Use retention policies to automatically delete content older than a specific date
C) Disable guest access entirely while manually re-inviting external collaborators
D) Configure SharePoint sensitivity labels to block external members from editing content
Answer:
A)
Explanation:
Managing external collaboration is one of the most detailed governance topics within the MS-102 domain because organizations often underestimate the risk associated with leftover guest accounts. Guests may retain access to documents, channels, SharePoint libraries, and Planner tasks long after the project ends. The challenge is not simply revoking access once, but doing so continuously and systematically. This is exactly what Entra ID Access Reviews provide. Access Reviews allow administrators to configure recurring scheduled reviews of group membership, application access, and even guest account presence. These reviews can be delegated to resource owners who are best positioned to assess who still needs access.
When an Access Review is created, administrators can include all guest users in a tenant, or target specific Microsoft 365 groups, Teams, SharePoint-connected groups, or enterprise applications. They can specify the frequency, such as monthly, quarterly, or annually. During the review, reviewers receive a notification asking them to evaluate each user’s justification for continued access. If the reviewer ignores or declines the request, Access Reviews can automatically remove the guest and revoke their access. This automation directly aligns with the organization’s need for continuous governance.
Option B focuses on retention policies. While they manage data lifecycle, they do not affect user access. Retention policies can remove or preserve documents, but they cannot revoke access rights for inactive guests.
Option C disables guest access entirely, contradicting the requirement to maintain external collaboration. Re-inviting all external users for each new engagement would create unnecessary friction and administrative overhead.
Option D uses sensitivity labels applied to SharePoint content. These labels can restrict external access or limit editing, but they do not remove guests from groups or evaluate guest lifecycle. Sensitivity labels focus on content protection rather than identity governance.
Access Reviews form the foundation of identity lifecycle management for external users. They ensure that access remains justified, prevent permission creep, and automatically enforce removal. This aligns with zero-trust principles and is the method auditors prefer because it creates verifiable logs of each review cycle. For these reasons, Option A is the best solution.
Question 99:
A company wants to restrict access to Microsoft 365 administrative portals based on strong authentication methods. Administrators must sign in using phishing-resistant methods such as FIDO2 or certificate-based authentication. The company wants to prevent administrators from accessing portals if they authenticate with weaker credentials like regular passwords or SMS codes. What configuration meets this requirement?
A) Create a Conditional Access policy that requires authentication strength set to phishing-resistant for admin roles
B) Force all administrators to disable password authentication and rely only on SMS MFA codes
C) Configure Exchange admin center settings to block access for accounts lacking hardware tokens
D) Enable basic authentication blocks and require POP/IMAP disablement for all privileged roles
Answer:
A)
Explanation:
Microsoft’s authentication strength framework is one of the newest identity security features and a critical topic in modern MS-102 exam objectives. Organizations increasingly migrate toward phishing-resistant methods because attackers have become more adept at bypassing legacy MFA through phishing kits, token replay attacks, session hijacking, and adversary-in-the-middle toolkits. Simply enabling MFA is no longer sufficient, particularly for administrative accounts. Authentication strength allows administrators to create Conditional Access policies that require specific credential categories rather than a generic MFA requirement.
Authentication strength categories include standards such as:
Phishing-resistant
• Passwordless MFA
• Multi-factor certificate-based
• FIDO2 keys
• Device-bound passkeys
In the scenario, administrators must use FIDO2 or certificate-based authentication. These are classified under phishing-resistant methods. By configuring a Conditional Access policy that applies to administrative roles—such as Global Administrator, SharePoint Administrator, Exchange Administrator, Teams Administrator, Security Administrator—the organization ensures that access to administrative portals cannot occur unless the sign-in is performed with a credential method aligned with the phishing-resistant authentication strength. If an administrator attempts to authenticate using a password, SMS code, phone call, or weaker method, the token request will be denied before the portal even loads.
Option B suggests using SMS codes, which fail the requirement. SMS-based MFA is vulnerable to SIM swap attacks, interception, and social engineering. It is not phishing-resistant. Forcing SMS does the opposite of strengthening authentication.
Option C attempts to restrict access through Exchange admin center settings. However, Microsoft 365 admin portals are accessed through multiple endpoints (Entra admin center, SharePoint admin center, Teams admin center, Security portal). Configuring a setting in one admin center does not secure all the others. Additionally, the requirement concerns authentication method enforcement, not portal-level blocking.
Option D references blocking basic authentication, which is essential for securing legacy protocols but has nothing to do with enforcing phishing-resistant sign-in methods for administrative portals. Blocking POP and IMAP is good hygiene, but irrelevant to the objective.
By focusing on authentication strength, the organization ensures that only strong, device-bound, phishing-resistant authentication mechanisms are permitted for privileged access. It moves beyond traditional MFA requirements and integrates tightly with zero-trust identity protection strategies. Therefore, Option A best satisfies the requirement.
Question 100:
An organization wants to ensure that only users in the finance department can communicate with each other using Teams and Exchange, and that they cannot share information with users outside the department. Which Microsoft 365 feature should the administrator implement?
A) Conditional Access policies
B) Information Barriers
C) Sensitivity labels
D) Exchange Online transport rules
Answer:
B)
Explanation:
Information Barriers (IB) are designed to enforce communication and collaboration restrictions between specific groups or segments of users within an organization. In this scenario, the organization wants to isolate the finance department so that its users can only communicate internally and cannot share data externally. Information Barriers achieve this by defining policies that control messaging, chats, and file sharing within Microsoft Teams, Exchange Online, and SharePoint.
Conditional Access is primarily focused on granting or blocking access based on user, location, device compliance, or risk conditions. It does not enforce internal communication boundaries between groups. While Conditional Access can limit access to Microsoft 365 resources, it does not restrict collaboration within applications based on department membership.
Sensitivity labels provide classification, encryption, and protection of documents and emails, but they cannot prevent communication or collaboration between users unless combined with complex conditional access or DLP rules. Even then, labels control content rather than interactions.
Exchange Online transport rules control email flow based on content or conditions like sender and recipient. They are effective for preventing certain messages from being sent externally but are not sufficient to manage Teams chats or SharePoint collaboration for departmental isolation.
For the MS-102 exam, administrators are expected to recognize that Information Barriers are the correct tool for controlling internal collaboration boundaries. They are particularly valuable in regulated industries where segregation of duties and confidentiality between departments is legally required. Implementing IB involves defining segments (e.g., finance, HR, legal) and policies that specify who can or cannot communicate. The policies automatically enforce restrictions across multiple workloads, including Exchange, Teams, and SharePoint, without needing to intervene manually for each user.
Configuration also includes testing and monitoring, where reports on policy violations or attempted unauthorized communication are available. Administrators can use the Microsoft 365 compliance center to review IB reports, ensuring policies are correctly applied. This is especially important in large organizations with dynamic personnel changes, ensuring that new hires in finance are automatically included in the appropriate segment.
Information Barriers are a part of Microsoft Purview solutions and integrate with identity management to ensure enforcement across workloads. This ensures compliance with internal and regulatory standards. It aligns with zero trust principles by explicitly defining permitted communication paths.
Question 101:
Your organization wants to ensure that Microsoft 365 users must complete multifactor authentication only when signing in from unknown locations or devices. What is the best approach to implement this requirement?
A) Enable Security Defaults for all users
B) Configure Conditional Access with location and device signals
C) Require MFA for all users without conditions
D) Enable Exchange Online transport rules
Answer:
B)
Explanation:
Conditional Access is the most appropriate solution because it allows administrators to evaluate multiple signals before enforcing MFA. In this scenario, the organization wants users to complete MFA only under specific conditions, such as signing in from unknown devices or locations. Conditional Access policies can evaluate risk factors including sign-in location, device state, user group membership, and risk detected by Microsoft Identity Protection. Policies are then applied dynamically, ensuring MFA is only required when the risk profile meets the configured conditions.
Security Defaults enforce MFA for all users without exception and do not support conditional triggers. This approach would cause unnecessary friction for users signing in from known and compliant devices, making it less suitable for scenarios that require selective MFA enforcement.
Requiring MFA for all users without conditions also lacks flexibility and can reduce productivity, as users may be prompted even for low-risk access.
Exchange Online transport rules are unrelated to authentication and MFA. They control email message flow and cannot evaluate device or location conditions.
Using Conditional Access for location and device evaluation allows the organization to balance security and usability. Administrators can define trusted locations (such as corporate offices) and compliant devices to bypass MFA while enforcing MFA for all other conditions. This approach integrates seamlessly with Microsoft Entra ID, Microsoft Defender for Identity, and Microsoft 365 risk-based sign-in detection.
From an MS-102 exam perspective, understanding Conditional Access policy design, including signals, conditions, and actions, is crucial. Candidates are expected to know when to use default security settings versus custom policies to meet organizational requirements. Conditional Access represents the modern approach to identity and access governance, offering both granular control and automated enforcement.
Question 102:
A company wants to assign Microsoft 365 licenses automatically to users in the HR department and revoke them if users leave the department. Which method should the administrator use to achieve this?
A) Manual license assignment in the Microsoft 365 admin center
B) Dynamic group-based licensing in Microsoft Entra ID
C) Intune device-based licensing
D) Exchange Online PowerShell scripts
Answer:
B)
Explanation:
Dynamic group-based licensing in Microsoft Entra ID allows for automated and attribute-driven license management. The organization’s goal is to ensure HR users receive licenses automatically upon joining the department and that licenses are revoked when users leave. Dynamic groups allow administrators to define membership rules based on user attributes such as department, job title, or location. Once a user meets the criteria, they are automatically added to the group, and the licenses assigned to that group are provisioned without manual intervention. When the attribute changes and the user no longer meets the criteria, they are automatically removed from the group and the licenses are revoked.
Manual license assignment is not suitable because it requires administrator intervention and cannot automatically adjust licenses when users change departments.
Intune device-based licensing applies only to certain device-targeted services and is irrelevant to user-centric services like Exchange, Teams, or SharePoint.
Exchange Online PowerShell can automate license assignment through scripting, but it requires ongoing maintenance, scheduling, and error handling. It is less efficient and scalable compared to dynamic group-based licensing.
For MS-102 exam purposes, dynamic groups are recognized as the best practice for license automation. They ensure accuracy, reduce administrative overhead, and maintain alignment between organizational attributes and license assignments. Organizations with frequent employee role changes or large user bases benefit significantly from this approach. Additionally, reports can be monitored to confirm that licensing rules are applied consistently, supporting compliance and operational efficiency.
Question 103:
An organization wants to ensure that all users accessing SharePoint Online and OneDrive from unmanaged devices can only view documents in a browser without downloading, printing, or copying the content. Which Microsoft 365 feature should be used to enforce this requirement?
A) Sensitivity labels
B) Conditional Access App Control session policies
C) Exchange Online transport rules
D) Security Defaults
Answer:
B)
Explanation:
Conditional Access App Control session policies, part of Microsoft Defender for Cloud Apps, allow administrators to monitor and control user sessions in real time for cloud applications, including SharePoint Online and OneDrive. The organization’s goal is to allow access from unmanaged devices but prevent users from extracting sensitive information. By using App Control session policies, organizations can enforce view-only access for these users, ensuring they cannot download, print, or copy content from the cloud apps.
Sensitivity labels are primarily used for classifying and protecting documents with encryption and access restrictions. While they can prevent access based on user permissions, they do not dynamically restrict session actions in real time. Users could still access files in supported applications or browsers unless additional controls are implemented.
Exchange Online transport rules are designed to manage the flow of emails and cannot govern user actions within SharePoint or OneDrive sessions. They are effective for email content inspection and routing but have no impact on web sessions or document handling in cloud storage.
Security Defaults provide baseline security, such as enforcing multi-factor authentication and blocking legacy authentication, but they lack the granularity needed to restrict specific actions within a user session. They do not prevent downloads, copying, or printing within cloud applications.
Implementation of Conditional Access App Control involves creating Conditional Access policies targeting SharePoint Online and OneDrive and then configuring session controls in Defender for Cloud Apps. Policies can be set to evaluate device compliance, location, user risk, and network state. For unmanaged devices, the session control can enforce view-only access, blocking the ability to download or print files, and restricting copy-paste actions.
From an operational perspective, this approach supports zero trust principles by dynamically evaluating user sessions and enforcing rules without completely denying access. It allows employees to perform necessary work while protecting sensitive information. Administrators can also generate reports to track compliance and policy effectiveness.
For the MS-102 exam, candidates must understand the differences between controlling access, classifying content, and enforcing session-level restrictions. Conditional Access App Control session policies are the correct solution because they provide dynamic, real-time protection that cannot be achieved with sensitivity labels, transport rules, or Security Defaults alone. This ensures organizational data remains secure, especially when accessed from unmanaged or external devices.
Question 104:
A company wants new employees in the marketing department to receive Microsoft 365 licenses automatically based on their department attribute and to revoke licenses if they leave the department. What is the recommended approach?
A) Assign licenses manually in the Microsoft 365 admin center
B) Configure dynamic group-based licensing in Microsoft Entra ID
C) Use Intune device-based licensing
D) Run a PowerShell script periodically to assign licenses
Answer:
B)
Explanation:
Dynamic group-based licensing in Microsoft Entra ID allows automatic assignment and revocation of licenses based on user attributes. In this scenario, the company wants to provision licenses automatically for new marketing employees and revoke them when users leave the department. By creating a dynamic group with membership rules based on the department attribute, users are added to the group when they match the criteria, and licenses assigned to the group are provisioned automatically. If the attribute changes, users are removed, and licenses are revoked without manual intervention.
Manual license assignment is not scalable and requires constant administrative attention. As employees join or leave departments, manually assigning or revoking licenses is prone to errors and inefficiencies.
Intune device-based licensing targets licenses based on devices rather than users, which is unsuitable when licenses need to follow user roles and attributes.
PowerShell scripts can automate assignments but require regular execution, monitoring, and maintenance. They do not provide real-time adjustment to attribute changes and are less efficient than dynamic groups.
Dynamic group-based licensing also supports evaluation intervals, ensuring licenses are applied promptly and revoked as needed. Administrators can maintain compliance, track usage, and manage license distribution efficiently. Reports on licensing and group membership help identify potential over- or under-provisioned licenses, supporting operational and financial planning.
For the MS-102 exam, candidates need to understand that dynamic groups in Microsoft Entra ID provide automated provisioning and revocation based on identity attributes. This method is best practice for organizations with frequent personnel changes, ensuring compliance, operational efficiency, and proper license management.
Question 105:
Your organization wants to prevent users from sending sensitive information outside the company via email. Administrators need a solution that can automatically detect sensitive content and enforce restrictions. Which feature should be used?
A) Conditional Access policies
B) Data Loss Prevention policies
C) Sensitivity labels only
D) Information Barriers
Answer:
B)
Explanation:
Data Loss Prevention (DLP) policies are designed to detect, monitor, and automatically protect sensitive information across Microsoft 365 services including Exchange Online, SharePoint Online, and OneDrive. In this scenario, the organization aims to prevent users from sending sensitive information externally via email. DLP policies automatically identify sensitive content such as financial data, social security numbers, or custom-defined content types. When a match is detected, administrators can enforce actions such as blocking the email, applying encryption, notifying compliance officers, or requiring user justification before sending.
Conditional Access policies focus on access control based on identity, device compliance, location, or risk, but they do not inspect email content. They cannot prevent the accidental sharing of sensitive information.
Sensitivity labels can classify and protect emails or documents with encryption and access restrictions. However, labels do not automatically enforce content detection or prevent external sharing unless integrated with DLP. They are effective for classification and protection but not for real-time policy enforcement on all outbound content.
Information Barriers prevent communication between defined organizational segments but do not inspect content. They ensure compliance in communication between groups but cannot stop sensitive information from being sent externally.
Implementing DLP policies involves defining rules that detect sensitive information, specifying conditions such as external recipients, and choosing enforcement actions. Organizations can monitor incidents, generate reports, and track compliance consistently. DLP supports regulatory requirements, reduces risk of data leakage, and automates enforcement, which minimizes manual intervention and operational overhead.
For the MS-102 exam, understanding DLP is essential as it integrates across multiple Microsoft 365 workloads to prevent accidental or intentional data exposure. It provides automated protection, aligns with organizational compliance policies, and ensures sensitive content is safeguarded while maintaining business operations.