Microsoft 365 Administrator Expert MS-102 Practice Question

Microsoft Entra Password Protection supports two operating modes for on-premises domain controllers: Audit and Enforce. In Audit mode the DC agent evaluates every password change against the global and custom banned password lists, writes the relevant event IDs to the local Security log and to Azure AD Password Protection reports, but still allows the password to be set. The cmdlet that toggles this behavior per Active Directory domain is Set-AzureADPasswordProtectionDomainMode. Running the cmdlet with the -Mode Audit parameter places the entire domain in audit-only operation, satisfying the requirement. Register-AzureADPasswordProtectionForest is used only for the initial forest registration and has no mode switch. Set-AzureADPasswordProtectionTenantBaselinePolicy applies cloud-only policies and cannot put on-premises DC agents into Audit. Set-ADDefaultDomainPasswordPolicy is an Active Directory cmdlet unrelated to Microsoft Entra Password Protection modes.