Microsoft SC-300 Practice Questions with Explanations

Correct answer: E

Microsoft 365 licenses can only be assigned directly to groups with membership type 'Assigned'. Looking at the table: Group1 (Assigned), Group4 (Assigned), and Group5 (Assigned) have the Assigned membership type. Group2 has Dynamic User membership and Group3 has Dynamic Device membership, neither of which support direct license assignment. Therefore, licenses can be assigned directly to Group1, Group4, and Group5 only.

Why the other options are wrong:

• A. Omits Group5, which has Assigned membership type and can receive direct license assignment.
• B. Incorrectly includes Group2 and Group3, which use Dynamic membership types that do not support direct license assignment.
• C. Incorrectly includes Group2 (Dynamic User type) and omits Group4 and Group5 (both Assigned type) which can receive licenses.
• D. Omits Group4 and Group5, both of which have Assigned membership type and can receive direct license assignment.

Correct answer: A

Set-MsolCompanySettings is the correct cmdlet to manage organizational settings in Azure AD, including self-service sign-up policies. This cmdlet allows you to disable self- service sign-up for specific domains, preventing users from creating accounts via self- service registration for Microsoft 365 services.

Why the other options are wrong:

• B. Set-MsolDomainFederationSettings configures federation settings for a domain, not self-service sign-up restrictions.
• C. Update-MsolfederatedDomain is used to update federated domain properties, not to control self-service sign-up.
• D. Set-MsolDomain manages domain properties but does not control self-service sign- up policies.

Correct answer: A

The key setting is 'Email One-Time Passcode for guests' which is set to 'Yes'. This means guests who cannot be authenticated through other methods will receive a one-time passcode via email. User1 is a guest user from contoso.com (external domain), so they will receive a passcode. User2 is from outlook.com (external domain) and has never accessed fabrikam.com resources, making them unable to be authenticated internally, so they will receive a passcode. User3 is from fabrikam.com (the same organization domain) and is described as 'a user in fabrikam.com', meaning they are a full member of the organization, not a guest, so they will not receive a passcode. Therefore, User2 only receives the passcode among those listed.

Why the other options are wrong:

• B. User1 is from contoso.com (external domain) but User2 from outlook.com without prior access to fabrikam.com resources is more likely to trigger the one-time passcode requirement.
• C. User3 is an internal user in fabrikam.com, not a guest, so they would not receive a one-time passcode email.
• D. User3 is an internal member of fabrikam.com, not a guest user, and therefore would not receive a one-time passcode.

Correct answer: C

The Licenses blade in the Azure AD admin center provides the least administrative effort for bulk license operations. After assigning E5 licenses to users via group-based licensing, you can use the Licenses blade to efficiently remove the E3 licenses from all 2,500 users simultaneously without manual per-user operations.

Why the other options are wrong:

• A. The Identity Governance blade is designed for access reviews and entitlement management, not bulk license removal.
• B. Set-AzureAdUser cmdlet would require scripting and individual user operations, requiring more administrative effort than using the admin center.
• D. Set-WindowsProductKey is a local Windows management cmdlet unrelated to Microsoft 365 license management.

Correct answer: E

Group3 is a mail-enabled security group. In Azure AD, mail-enabled security groups can only contain users as direct members; they cannot contain other groups (whether security groups or mail-enabled security groups) as members. This is a key limitation of mail- enabled security groups compared to standard security groups. Therefore, only User2 can be added as a member to Group3, since User1 has no license assigned and cannot be added, while Group1 and Group2 are groups and cannot be members of a mail-enabled security group.

Why the other options are wrong:

• A. Group2 cannot be added to Group3 because mail-enabled security groups cannot contain other groups as members.
• B. Group1 and Group2 cannot be added to Group3 because mail-enabled security groups cannot contain other groups as members.
• C. User1, Group1, and Group2 cannot be added; User1 has no license and groups cannot be members of mail-enabled security groups.
• D. User1 cannot be added to Group3 as User1 has no directly assigned license.

Correct answer: B

Password writeback synchronizes password changes from Azure AD back to on-premises Active Directory. However, it does not affect the authentication behavior of disabled accounts. The 30-minute delay occurs due to token caching and synchronization intervals, which password writeback does not address. This solution does not meet the goal.

Why the other options are wrong:

• A. Password writeback is unrelated to preventing authentication of disabled accounts; it only handles password synchronization direction.

Correct answer: A

Pass-through authentication validates user credentials directly against on-premises Active Directory for every sign-in attempt. When a user account is disabled in Active Directory, pass-through authentication immediately rejects authentication requests since it checks the actual on-premises account status in real-time, eliminating the 30-minute delay caused by token caching.

Why the other options are wrong:

• B. Pass-through authentication directly validates against on-premises AD in real-time, which meets the requirement of immediate prevention of authentication for disabled accounts.

Correct answer: B

Conditional access policies control whether users can access applications based on conditions, but they cannot directly validate real-time account status in on-premises Active Directory. The 30-minute delay stems from token caching in Azure AD, which conditional access policies cannot override. This solution does not address the root cause of the authentication delay.

Why the other options are wrong:

• A. Conditional access policies operate on Azure AD tokens and cached identity information, not on real-time on-premises account status checks.

Correct answer: B

When assigning a Microsoft 365 Enterprise E5 license to Group1, the license is consumed only by direct user members who are licensed objects. Group1 contains User1, User3, Group2, and Group4. User1 and User3 are direct users and will consume licenses. Group2 is a Dynamic User group containing User2, but nested group members don't consume licenses from the parent group assignment. Group4 is a Microsoft 365 group, which itself doesn't consume a license. Therefore, only 2 licenses (for User1 and User3) are used when assigning the license to Group1.

Why the other options are wrong:

• A. Zero licenses cannot be correct as Group1 contains direct user members (User1 and User3) who would be assigned the license.
• C. Three licenses is incorrect because nested members through Group2 and Group4 are not counted; only the 2 direct user members (User1 and User3) consume licenses.
• D. Four licenses is incorrect as it would require counting all unique users, but nested group membership and device members do not consume licenses in group-based assignment.

Correct answer: D

To provide a contractor using an external email (user1@outlook.com) access to an Azure AD enterprise application while maintaining their external identity, you must create a guest user account in the contoso.com tenant. This allows the contractor to authenticate as their external identity while being part of the organization's directory for application access.

Why the other options are wrong:

• A. New-AzADUser creates native Azure AD user accounts, not guest accounts for external identities.
• B. External collaboration settings control guest invitation policies but do not provision access; you still need to create the guest account.
• C. Configuring a WS-Fed identity provider is used for federated authentication scenarios, not for adding individual guest users.

Correct answer: C

To prevent synchronization of users based on an attribute value (extensionAttribute15 set to NoSync), you must create an inbound synchronization rule for the Active Directory Domain Services connector. This rule filters objects during the import phase from on- premises AD, preventing users with this attribute value from being synchronized to Azure AD.

Why the other options are wrong:

• A. An inbound rule for the Azure AD connector operates on data flowing into Azure AD, not filtering source data from Active Directory.
• B. A Full Import run profile performs import operations but does not create filtering rules; rules must be configured separately.
• D. An Export run profile handles data flowing from Azure AD to on-premises, not filtering incoming synchronization from AD.

Correct answer: A

When connectivity from on-premises to the internet is lost, Azure AD Connect cannot synchronize or perform cloud-based authentication. User1 can sign in because User1 is a standard User type with directory sync disabled (No), meaning User1's credentials are managed directly in Azure AD and do not depend on on-premises synchronization. User2 cannot sign in despite being a User type because User2 has directory sync enabled (Yes), creating a dependency on Azure AD Connect synchronization which requires internet connectivity. User3 cannot sign in because User3 is a Guest type, and guest accounts typically require cloud-side provisioning or federation mechanisms that depend on the Azure AD Connect infrastructure being operational. Only User1, whose authentication is completely independent of the on-premises domain connection, can authenticate when connectivity is lost.

Why the other options are wrong:

• B. User3 can also sign in as a Guest account when directory sync is not required, making this answer incomplete.
• C. User2 cannot sign in because their directory sync is enabled and requires Azure AD Connect to synchronize with the on-premises domain, which is unreachable.
• D. User2 cannot sign in because directory sync is enabled, creating a dependency on the Azure AD Connect service that cannot function without internet connectivity to the on-premises domain.

Correct answer: B

Azure AD Password Protection is used to enforce custom password policies and block weak passwords; it does not address the 30-minute authentication delay when an on- premises Active Directory user account is disabled. The delay occurs due to Azure AD Connect sync intervals and token caching. To immediately prevent authentication, you would need to configure Azure AD Connect to sync more frequently or implement conditional access policies that check real-time account status, not password protection.

Why the other options are wrong:

• A. Password Protection does not control account disable synchronization timing or immediate authentication prevention.

Correct answer: C

To ensure External Identities pricing is based on monthly active users (MAU), you must link an Azure subscription to your Azure AD tenant. This linked subscription enables MAU- based billing, which charges based on the number of unique users authenticating in a calendar month. Without a linked subscription, External Identities may use different billing models or be unavailable.

Why the other options are wrong:

• A. User flows define authentication behavior but do not configure billing models.
• B. Terms of use are for compliance and acceptance tracking, not billing configuration.
• D. Access reviews are for governance and compliance, not billing setup.

Correct answer: C

Company branding settings in the Microsoft Entra admin center allow you to customize the sign-in experience, including language-specific sign-in forms. You can configure localized branding that displays the Spanish sign-in form when users access from Microsoft Edge with their browser language set to Spanish. This is the direct mechanism for controlling localized authentication UI.

Why the other options are wrong:

• A. Usage location is a user property for licensing and feature availability, not for UI localization.
• B. Global Secure Access Session management controls session behavior and security, not language-based sign-in form presentation.
• D. Conditional Access policies control access permissions and authentication requirements, not UI localization.

Correct answer: A

Pass-through authentication agents must be installed on servers that can communicate with Azure AD while meeting security requirements. Server4 is an unassigned member server, making it ideal for installing additional pass-through authentication agents because: (1) it is not a domain controller, so it won't violate the policy against DCs communicating directly to the internet; (2) as a member server with no assigned role, it has minimal required software and can dedicate resources to the authentication agent; (3) multiple agents on member servers provide redundancy for user authentication if other agents fail. Installing on any domain controller would violate the corporate security policy.

Why the other options are wrong:

• B. Server2 is an infrastructure master domain controller, and the security policy explicitly prohibits domain controllers from communicating directly to the internet.
• C. Server1 is a PDC emulator domain controller, and the security policy explicitly prohibits domain controllers from communicating directly to the internet.
• D. Server3 is the Azure AD Connect server, which already handles directory synchronization and does not need additional pass-through authentication agents installed on it.

Correct answer: A

The New-AzureADMSInvitation cmdlet is used to invite external users (such as contractors with @outlook.com accounts) to an Azure AD tenant and provide them access to enterprise applications. This cmdlet generates an invitation that allows the contractor to authenticate with their external credentials (user1@outlook.com) while gaining access to App1.

Why the other options are wrong:

• B. External collaboration settings control policies for invitations but do not directly provision the guest user access.
• C. WS-Fed identity providers are for federated authentication scenarios, not for inviting external users with personal credentials.
• D. Azure AD Connect is for synchronizing on-premises Active Directory to Azure AD, not for adding external guest users.

Correct answer: D

The New-MgInvitation cmdlet (Microsoft Graph API equivalent to New- AzureADMSInvitation) is used to invite external users to a Microsoft Entra tenant and provide them access to enterprise applications. This cmdlet allows the contractor to authenticate as user1@outlook.com and grants them access to App1 as a guest user.

Why the other options are wrong:

• A. Microsoft Entra Connect sync is for synchronizing on-premises Active Directory, not for inviting external guest users.
• B. Adding a custom domain name allows the tenant to use a custom domain but does not provision guest user access for external contractors.
• C. Application Proxy extends on-premises applications to cloud access but does not directly provision guest user access for external identities.

Correct answer: C

When bulk creating users in Azure AD via template upload, the required properties are accountEnabled, displayName, userPrincipalName, and passwordProfile. These properties are mandatory to create a functional user account that can sign in and authenticate to Azure AD services. The displayName identifies the user, userPrincipalName serves as the unique identifier, accountEnabled sets the account status, and passwordProfile defines the password.

Why the other options are wrong:

• A. identityIssuer is not a standard required property for bulk user creation; usageLocation is optional.
• B. givenName and surname are optional; the required set must include displayName and passwordProfile.
• D. usageLocation is optional for licensing but not required for basic user creation; this set lacks displayName which is required.

Correct answer: C

To enable Azure AD Seamless Single Sign-On on Windows 10 domain-joined computers, you must modify the Intranet Zone settings in Internet Explorer/Microsoft Edge to allow automatic logon using the user's domain credentials. This configuration allows the Seamless SSO authentication agent to transparently authenticate users without prompting for credentials when accessing cloud resources.

Why the other options are wrong:

• A. Sign-in options in Settings control local Windows authentication methods, not Azure AD Seamless SSO cloud authentication.
• B. Enterprise State Roaming synchronizes user settings and data across devices but does not enable Seamless SSO functionality.
• D. The Azure AD Connect Authentication Agent is installed server-side to support Seamless SSO, not on individual Windows 10 clients.

Correct answer: C

To enable User1 to create new catalogs and add resources to owned catalogs in Azure AD, you must modify the Entitlement management settings from the Identity Governance blade. This setting grants users the ability to create and manage catalogs within the entitlement management system, controlling access packages and resource provisioning.

Why the other options are wrong:

• A. Groups administrator role controls group management, not entitlement management catalog creation.
• B. Service support administrator role handles support ticket management and service health, not catalog creation.
• D. Roles and administrators for the General catalog would assign administrative permissions within an existing catalog, not grant the ability to create new catalogs.

Correct answer: C

Azure AD Seamless SSO requires modifying the Local intranet Zone settings to add the Azure AD tenant's internal domain (typically *.microsoftonline.com or the internal domain). This allows Windows 10 computers to perform Kerberos authentication transparently without additional prompts. The Local intranet Zone setting enables the browser and Windows to automatically send credentials for seamless authentication.

Why the other options are wrong:

• A. Sign-in options in Settings app controls local sign-in behavior, not cloud-based SSO configuration.
• B. Enterprise State Roaming is for syncing user settings across devices, not for enabling Seamless SSO.
• D. The Azure AD Connect Authentication Agent is installed on servers running Azure AD Connect, not on individual Windows 10 client computers.

Correct answer: B

Inviting Contoso East users as guests in the Contoso West tenant is the correct solution because it requires no additional Microsoft 365 licenses (guests can access SharePoint Online without licenses), doesn't require syncing directories across tenants, and leverages Azure AD B2B collaboration capabilities that are built into both tenants. This is the standard, supported method for cross-tenant resource sharing in Microsoft 365 environments where users from one organization need access to another organization's resources.

Why the other options are wrong:

• A. Azure AD Application Proxy is for publishing on-premises applications to cloud users, not for granting access to SharePoint Online in another tenant.
• C. Deploying a second Azure AD Connect server would violate supported configurations and create directory synchronization conflicts between tenants.
• D. Configuring the existing Azure AD Connect server to sync to a different tenant is not a supported scenario and would create identity conflicts and synchronization issues.

Correct answer: D

User5 is assigned the User administrator role scoped to Au1 (administrative unit). This role grants password reset permissions only for users who are members of Au1. According to the table, the members of Au1 are: Group1, User2, and User3. User2 and User3 are explicitly listed as Au1 members. Group1 is also a member of Au1, but Group1 itself is not a user account. User1 is a member of Group1 but is not directly listed as an Au1 member, so User5 cannot reset User1's password. User4 is in Group2, which is not a member of Au1. Therefore, User5 can only reset passwords for User2 and User3.

Why the other options are wrong:

• A. User1 is not a direct member of Au1; User1 belongs to Group1 but the scope is limited to listed members, and User1 is not individually listed as an Au1 member.
• B. User3 is a member of Au1, so User5 can reset User3's password; this option incorrectly excludes User3.
• C. User4 belongs to Group2, which is not a member of Au1, so User5 cannot reset User4's password; User1 is also not eligible.

Correct answer: D

The rule syntax must be evaluated carefully with proper operator precedence. The rule is: (user.usageLocation -in ["US","AU"] -and user.department -eq "Sales" -and -not (user.jobTitle -eq "Manager")) -or (user.jobTitle -eq "SalesRep"). For User1: usageLocation=US ( ), department=Sales ( ), jobTitle=Associate (not Manager, ) → first condition TRUE → matches. For User2: usageLocation=Finland ( not in US/AU), but jobTitle=SalesRep ( ) → second condition TRUE → matches. For User3: usageLocation=Australia ( ), department=Sales ( ), jobTitle=Manager ( fails -not condition) → first condition FALSE, jobTitle≠SalesRep → second condition FALSE → does not match. Therefore, User1 and User2 are added to the group.

Why the other options are wrong:

• A. User2 also matches because their jobTitle is 'SalesRep', which satisfies the second part of the OR condition.
• B. User1 also matches the first part of the rule (US location, Sales department, not a Manager).
• C. User3's jobTitle is Manager, which fails the -not condition in the first part, and does not equal 'SalesRep' in the second part.
• E. User3 does not match; the Manager job title fails the -not (user.jobTitle -eq "Manager") condition.
• F. User3 does not match either the first compound condition (fails Manager exclusion) or the second condition (jobTitle is not SalesRep).

Correct answer: D

The User Administrator role has permissions to manage license assignments and reset user passwords. This role can create and manage users, reset passwords, manage licenses, and invalidate refresh tokens. While Helpdesk Administrator can reset passwords, it cannot manage license assignments. License Administrator can only manage license assignments but not reset passwords.

Why the other options are wrong:

• A. Helpdesk Administrator can reset passwords but cannot manage license assignments.
• B. Billing Administrator manages subscription billing and purchases, not user licenses or passwords.
• C. License Administrator can only manage license assignments, not reset user passwords.

Correct answer: A

The Set-MsolUserLicense cmdlet is the most efficient method for removing licenses from 2,500 users in bulk. This PowerShell cmdlet allows batch operations to remove the Enterprise E3 licenses from multiple users programmatically with minimal administrative effort, whereas manual removal or other methods would be time-consuming.

Why the other options are wrong:

• B. Set-AzureADGroup modifies group properties, not user license assignments.
• C. Set-WindowsProductKey is unrelated to Microsoft 365 license management.
• D. Administrative units are for organizing user management but don't provide license removal functionality.

Correct answer: B

The New-MgInvitation cmdlet is used to invite external users (guest users) to an Azure AD tenant. This allows a contractor with user1@outlook.com credentials to be invited as a guest user and then granted access to App1. The invitation process enables external authentication while maintaining organizational control over access.

Why the other options are wrong:

• A. New-MgUser creates internal users in the tenant, not external guest users with external identities.
• C. External collaboration settings control whether invitations are allowed, but don't create the invitation itself.
• D. Azure AD Connect sync is for synchronizing on-premises AD to cloud, not for inviting external users.

Correct answer: A

The Groups blade in the Azure Active Directory admin center provides the least administrative effort for this scenario. When licenses are assigned to a group, removing users from that group automatically removes the associated licenses. This is more efficient than PowerShell commands for this specific task of transitioning from individual E3 assignments to group-based E5 assignments.

Why the other options are wrong:

• B. Set-AzureADGroup modifies group settings but doesn't directly manage license removals.
• C. Identity Governance blade is for access reviews and entitlement management, not bulk license removal.
• D. Set-MsolUserLicense requires individual user processing rather than group-level management.

Correct answer: B

Conditional access policies cannot prevent disabled accounts from authenticating immediately. The 30-minute delay occurs due to Azure AD's token caching and synchronization mechanisms. To immediately prevent authentication, you would need to use Azure AD Connect's password hash sync with immediate sync cycles or implement sign-in frequency policies, but conditional access policies themselves don't address the root cause of disabled account authentication delays.

Correct answer: B

The Exchange Administrator role does not have permissions to update Identity Secure Score improvement actions. The Security Administrator role is required for managing and updating Identity Secure Score. Exchange Administrator is limited to Exchange Online management and cannot access security score features.

Correct answer: B

The User Administrator role does not have permissions to update Identity Secure Score improvement actions. The Security Administrator role is specifically required for this task. User Administrator is limited to user and group management and lacks the security-related permissions needed for Identity Secure Score updates.

Correct answer: A

The sales department users are reaching their device limit and cannot join additional devices to Azure AD. The problem statement explicitly mentions 'Increase the maximum number of devices that can be joined or registered to Azure AD to 10' as a planned change. The Device settings in Azure AD tenant configuration is where the maximum device limit is configured. This setting controls how many devices each user can register or join to the Azure AD tenant, directly addressing the issue where users have up to five devices and are hitting the limit.

Why the other options are wrong:

• B. User settings control password expiration, MFA requirements, and similar user-level policies, not device join limits.
• C. Access reviews settings are for reviewing access to resources and applications, not for managing device join limits.
• D. Security defaults control baseline security policies like MFA enforcement and blocking legacy authentication, not device registration limits.

Correct answer: B

The issue states that when attempting to assign the Device Administrators role to IT_Group1, the group does NOT appear in the selection list. In Azure AD, only certain types of groups can be assigned administrator roles. IT_Group1 is currently a Security group with Assigned membership type. However, Azure AD role assignments require groups to be created with role-assignable capability enabled, which means the group must be recreated with the proper configuration (specifically, the isAssignableToRole property must be set to true during creation). This is a one-time configuration that cannot be changed after group creation, making recreation the necessary first step to resolve the issue.

Why the other options are wrong:

• A. Changing to Dynamic User membership type does not address the underlying issue that the group was not created with role-assignable capability enabled, which is required for administrator role assignment.
• C. Device membership type is for device-based groups and is irrelevant to assigning administrator roles to user groups.
• D. Adding an owner to IT_Group1 does not resolve the issue; the group still lacks the role-assignable capability that is necessary for administrator role assignment and cannot be retroactively enabled.

Correct answer: A

The requirement states that trust relationships must NOT be established between adatum.com and litware.com AD DS domains, and that Litware's AD DS users and groups must be synced with the Azure AD tenant. Azure AD Connect cloud sync is the appropriate solution because it allows synchronization of multiple forests without requiring trust relationships between them. Cloud sync can connect to litware.com independently through cloud provisioning agents, whereas traditional Azure AD Connect would require either a trust relationship or direct network connectivity, and staging mode is only for testing/validation purposes, not production synchronization.

Why the other options are wrong:

• B. Azure AD Connect (directory sync) to include litware.com would require establishing trust relationships or direct domain connectivity between adatum.com and litware.com, which violates the explicit technical requirement that trust relationships must NOT be established.
• C. Staging mode in Azure AD Connect is a testing and validation feature, not a production synchronization method, and does not address the requirement to sync litware.com independently without trust relationships.

Correct answer: E

In Azure, the Contributor role can be assigned to any identity that can be granted permissions on a resource group. This includes user accounts (User1), security groups using dynamic membership (Group1), virtual machines with system-assigned managed identities (VM1), and enterprise applications (App1). All four of these identity types are valid principals that can receive role assignments in Azure RBAC. Therefore, all of them can be assigned the Contributor role for RG1.

Why the other options are wrong:

• A. User1 alone is insufficient; Group1, VM1, and App1 can also receive role assignments on the resource group.
• B. This excludes VM1 and App1, which are both valid identities that can be assigned roles on a resource group.
• C. This excludes Group1 and App1; security groups with dynamic membership and enterprise applications can both receive role assignments.
• D. This excludes Group1, which is a valid security group that can be assigned the Contributor role on a resource group.

Correct answer: D

The Licenses blade in the Azure Active Directory admin center is the least administratively effortful way to remove individual user licenses in bulk. While group-based licensing assigned the E5 licenses to all users via the group, removing the E3 licenses from 2,500 individual users is most efficiently done through the Licenses blade where you can bulk- manage user licenses without needing PowerShell commands or other administrative tools.

Why the other options are wrong:

• A. The Groups blade is for managing group membership and group-level licensing, not for removing individual user licenses in bulk.
• B. Using Set-AzureAdUser cmdlet would require scripting and more administrative effort than using the Licenses blade GUI.
• C. The Identity Governance blade handles access reviews and entitlement management, not license removal.

Correct answer: B

The Security Operator role cannot update the status of Identity Secure Score improvement actions. The Security Operator role can only read security information and view reports but cannot make changes to improvement actions. To update Identity Secure Score improvement actions, a higher privilege role such as Security Administrator is required.

Why the other options are wrong:

• A. This is incorrect because Security Operator lacks the write permissions needed to update improvement action status.

Correct answer: B

The SharePoint Administrator role manages SharePoint Online services and settings, not Identity Secure Score or security posture improvements. This role has no permissions related to updating Identity Secure Score improvement actions, which fall under security management responsibilities. This does not meet the stated goal.

Why the other options are wrong:

• A. SharePoint Administrator is focused on SharePoint management and lacks permissions for Identity Secure Score improvement action updates.

Correct answer: D

A custom role is the solution that minimizes administrative effort while precisely meeting the requirements. The Helpdesk Administrator role is a built-in role that grants broader permissions than needed and would not align exactly with the specific tasks required. A custom role can be created with only the specific permissions for creating and managing service requests, reading and configuring service health, and creating and managing support tickets.

Why the other options are wrong:

• A. Administrative units are used to scope role permissions by organizational unit, not to create specific permission sets for the stated tasks.
• B. Azure AD PIM is for elevating privileges and managing eligible role assignments, not for granting specific functional permissions.
• C. Helpdesk Administrator is too broad and grants more permissions than the specific tasks listed, making it less efficient.

Correct answer: A

According to the exhibit, the Collaboration restrictions setting is configured to 'Allow invitations to be sent to any domain (most inclusive)'. This means guests can be invited from any domain. When a user shares a SharePoint document library to external users, a passcode is sent only to those users who are not already members of the Azure AD tenant or don't have an existing account. User1 (contoso.com) and User2 (outlook.com) are external to fabrikam.com and will receive passcodes. User3 (fabrikam.com) is internal to the organization and already has an Azure AD account in the tenant, so User3 will not receive a passcode but will receive a direct share notification instead. However, User2 is described as 'a user who has never accessed resources in fabrikam.com,' making User2 an external user requiring a passcode. User1 is explicitly described as 'a guest user in fabrikam.com,' indicating prior access. Upon closer analysis of passcode requirements: external users from domains outside fabrikam.com who are being invited for the first time receive passcodes. Only User2 (outlook.com, never accessed) requires a passcode as a completely external user without prior relationship.

Why the other options are wrong:

• B. User1 is already a guest user in fabrikam.com with prior access, so User1 would not receive a passcode but rather a direct share link.
• C. User3 is internal to fabrikam.com domain and has an existing Azure AD account, so User3 receives a direct share notification, not a passcode.
• D. User3 is an internal user in the fabrikam.com tenant and does not receive a passcode.

Correct answer: C

Cross-tenant synchronization in Microsoft Entra syncs users and Microsoft 365 groups, but not security groups. From the table, User1 is a User type and Group2 is a Microsoft 365 group, so both will sync to fabrikam.com. Group1 is a Security group and will not be included in the cross-tenant synchronization process.

Why the other options are wrong:

• A. User1 alone is incomplete; Group2 (Microsoft 365 group) also syncs in cross-tenant synchronization.
• B. Group1 is a security group, which is not synchronized in cross-tenant synchronization; only Microsoft 365 groups are synced.
• D. Group1 is a security group and will not sync; only User1 and Group2 are synchronized.

Correct answer: B

The Licenses blade in the Azure Active Directory admin center is the least administratively effortful method to remove individual user licenses in bulk. This centralized interface allows direct management and removal of user licenses without requiring PowerShell scripting or other complex administrative procedures.

Why the other options are wrong:

• A. Update-MgGroup cmdlet is used for group management, not for removing individual user licenses.
• C. Set-WindowsProductKey cmdlet is for Windows licensing, not Microsoft 365 or Azure AD license management.
• D. Administrative units are used to scope administrative roles, not to manage license assignment or removal.

Correct answer: C

The Microsoft Entra admin center (formerly Azure AD admin center) is the dedicated portal for managing Azure AD identities, roles, and permissions. It provides comprehensive role management capabilities where you can view, compare, and manage administrator roles and their permissions. This is the native tool designed specifically for reviewing and comparing role-based access control (RBAC) permissions in Azure AD, making it the most efficient solution that minimizes administrative effort by centralizing all role management tasks.

Why the other options are wrong:

• A. Microsoft 365 Defender portal is primarily focused on security threats, incident response, and threat protection rather than role and permission management.
• B. While the Microsoft 365 admin center can view some user information, it is not the primary tool for comparing detailed Azure AD role permissions and is less comprehensive than Entra admin center for this specific task.
• D. Microsoft Purview compliance portal is focused on data governance, privacy, and compliance management, not user role and permission administration.

Correct answer: A

The Update-MgOrganization cmdlet is used to configure organizational settings in Azure AD, including the ability to restrict self-service sign-up for specific domains. This cmdlet allows you to disable self-service sign-up for the contoso.com domain, preventing users from creating self-signed accounts in the Azure AD tenant.

Why the other options are wrong:

• B. Update-MgPolicyPermissionGrantPolicyExclude manages consent policy exceptions, not self-service sign-up restrictions.
• C. Update-MgDomain manages domain properties and verifications, not self-service sign-up policies.
• D. Update-MgDomainFederationConfiguration manages federation settings between domains, not self-service sign-up controls.

Correct answer: D

When an external user's email address is updated in Azure AD, the user's redemption status becomes invalid because it was tied to the original email address. Resetting the redemption status sends a new invitation to the updated email address, allowing the user to re-authenticate with their new email credentials. This is the proper procedure for updating contact information for external (guest) users in Azure AD B2B collaboration scenarios.

Why the other options are wrong:

• A. Authentication methods settings control how a user authenticates (MFA, passwordless, etc.) but do not resolve email address changes or redemption issues.
• B. Resetting the password does not address the fundamental issue that the redemption status is tied to the old email address and must be redeemed with the new one.
• C. Revoking active sessions terminates current sign-in sessions but does not enable authentication with the new email address or resolve the underlying redemption status problem.

Correct answer: A

External collaboration settings is the correct configuration location for controlling which external domains can be invited as guests to an Azure AD tenant. This setting allows administrators to create allow or deny lists of external domains, restricting guest invitations to only approved organizations.

Why the other options are wrong:

• B. All identity providers configures authentication methods, not guest domain restrictions.
• C. Cross-tenant access settings manages access policies between different Azure AD tenants, not guest domain restrictions.
• D. Linked subscriptions is not a valid Azure AD configuration setting for guest access control.

Correct answer: B

Creating an access review is the correct approach to ensure User1 is notified every three months to validate guest membership of Group1. Access reviews allow owners to periodically review and certify guest member access, with configurable recurrence intervals including quarterly schedules.

Why the other options are wrong:

• A. External collaboration settings controls which external domains can be invited as guests, not membership validation reviews.
• C. Access packages are for entitlement management and self-service access requests, not for periodic membership validation.
• D. Group expiration policy sets when groups expire, not for regular membership validation by owners.

Correct answer: B

The Billing Administrator role has the minimum permissions needed to purchase licenses for an Azure subscription. This role can manage billing and purchases without the excessive permissions of Global Administrator, and it's more appropriate than Permissions Management Administrator (which manages permissions, not licensing) or User Access Administrator (which manages role assignments).

Why the other options are wrong:

• A. Global Administrator grants far more permissions than necessary, violating the principle of least privilege.
• C. Permissions Management Administrator manages permissions and policies, not license purchases.
• D. User Access Administrator manages role assignments and access control, not license procurement.

Correct answer: B

A minimum of 2 role assignments achieves all requirements: First, assign Reader role at the subscription level to allow viewing all resources. Second, assign a custom role or Contributor at the subscription level for VM restart capability combined with a scoped assignment (Contributor on RG1 only) for creating VMs and storage accounts in RG1. Alternatively, Reader at subscription scope plus a custom role scoped to RG1 for create operations satisfies all four tasks with 2 assignments.

Why the other options are wrong:

• A. A single role cannot satisfy all requirements because resource creation must be scoped to RG1 only while viewing and VM restart must be at subscription level.
• C. Three assignments are more than the minimum needed when roles are properly scoped.
• D. Four assignments exceed the minimum necessary to accomplish these tasks.