Microsoft 365 Administrator Expert Practice Test (MS-102)

The ability to enter a numeric threshold and time window is exposed only when the alert policy is set to trigger "when activities match rule conditions" rather than "every time an activity matches." Selecting the threshold-based trigger lets you specify both the minimum number of matching activities (five) and the aggregation window (30 minutes). Adjusting severity, category, or scoping settings does not display the threshold controls; they affect alert prioritization or targeting but not how often the alert fires.

In the Groups & sites settings of the sensitivity label, the Access from unmanaged devices option evaluates whether the connecting device is hybrid-joined or compliant. Setting this option to Block (or Web-only) prevents access from devices that are not trusted. Privacy controls only whether the site is public or private, external sharing determines if guest users are allowed, and the default sharing link type governs the link created for shared files; none of these examine device state.

The Azure AD Connect Health for Sync dashboard contains several blades. The Password Sync blade shows a per-server chart of the time that elapses between a password change in Active Directory and the successful upload of the new hash to Microsoft Entra ID. This metric is called Password Sync Latency and is the only location in Connect Health where the value is surfaced. The Directory Sync Status blade shows overall synchronization cycles, not password-hash latency. The Alerts blade lists threshold breaches but does not display the actual latency metric, and the Sync Errors blade focuses on failed object exports and import errors, not latency.

A PowerShell script that reads a CSV file, runs New-AzureADMSInvitation to send Azure AD B2B invitations, and then uses Add-AzureADGroupMember (or Microsoft Graph equivalents) to add the resulting guest accounts to the Microsoft 365 group can execute end-to-end in a single script run. The Bulk invite wizard cannot put users in a Microsoft 365 group during the same upload, Bulk create would create internal accounts, and an Entitlement Management access package requires additional interactive configuration rather than a one-step CSV-driven process.

A File policy supports granular filters such as Classification label equals Confidential together with Exposure equals External. File policies can also trigger governance actions, including Remove shared link, which revokes the external-sharing link while sending an alert that contains a link to the file. Access policies provide real-time session controls but do not act on already shared content. Activity policies can alert on specific activities but cannot automatically remove sharing links. Anomaly detection policies identify unusual behavior patterns and do not offer targeted governance actions for individual files.

The User risk policy action Require password change depends on the self-service password reset (SSPR) flow. Users must already have registered authentication methods before they can reset their own password. Enabling the Microsoft Entra MFA registration policy prompts unregistered users to register security information (used by both MFA and SSPR) at their next sign-in. Once registration is complete, Medium-risk users can satisfy the policy by performing an SSPR-based password change instead of being blocked. Changing the User risk policy to require MFA, altering the Sign-in risk policy, or adding a Conditional Access policy would not meet the stated requirement of forcing a password change at Medium user risk.

Microsoft Entra Password Protection for on-premises AD requires both the DC agent and the proxy service. The proxy service, installed on at least one domain-joined server, authenticates to Microsoft Entra ID, retrieves the global and custom banned-password lists, and makes them available to the DC agents. Features such as password hash synchronization or writeback do not deliver the banned-password lists, and LDAP traffic to Microsoft Entra ID is not used for this purpose.

Service health alert rules let administrators choose the affected services, incident or advisory types, and the delivery method for notifications. When the rule is linked to the built-in Power Automate template, each new service-health post automatically triggers a flow that can deliver the information to a specified Teams channel. Message center preferences are limited to email and RSS and do not post to Teams, Microsoft Graph change-notification subscriptions require custom development, and network-connectivity health policies are unrelated to service-health events.

MDCA can ingest telemetry collected by the MDE sensor and automatically populate continuous Cloud Discovery reports. To activate this flow, you must turn on the Microsoft Defender for Endpoint integration under Settings > Cloud Discovery > Automatic log upload in the MDCA portal. App connectors integrate sanctioned SaaS apps but do not deliver discovery data, a log collector is unnecessary when endpoint telemetry is available, and snapshot reports rely on manual log uploads rather than the desired continuous feed.

Before any policies can be created, Microsoft 365 Backup must be explicitly turned on for the tenant in the Microsoft 365 admin center. Simply having the Backup Administrator role, accessing the Microsoft 365 Backup portal, or choosing a storage location is not enough-the service must first be enabled. Once Microsoft 365 Backup is turned on, you can then define backup policies for Exchange Online, SharePoint Online, and OneDrive.

Group-based licensing in Microsoft Entra ID supports automatic license management when the license is assigned to a security or Microsoft 365 group. If that group is dynamic, membership is evaluated continuously, so users that meet the rule (EmployeeType equals FTE) are added and are granted the assigned licenses. When a user no longer meets the rule, the user leaves the group and the service automatically revokes the license. Manual assignment from the Microsoft 365 admin center, entitlement management access packages, or maintaining a static group with scripts all require ongoing administrative effort and do not guarantee immediate, attribute-driven removal of licenses.

Safe Attachments policies are processed in order of priority (0 is evaluated first). Because the Finance user is in the scope of the custom policy that has priority 0, that policy is applied instead of the built-in policy. In Dynamic Delivery mode the message body is delivered immediately, but each attachment is replaced by a placeholder until the file is scanned. If the attachment is determined to be malicious, the placeholder is removed and the user never gains access to the file; the message body remains in the mailbox. The built-in policy set to Block mode is ignored because it has lower priority.

Because Windows 10 version 2004 and later (including all Windows 11 builds) include the Microsoft Defender for Endpoint sensor natively, you can onboard these devices by simply enabling the Microsoft Defender for Endpoint setting in an Endpoint detection and response policy. Creating and assigning an Endpoint security - Endpoint detection and response profile with Microsoft Defender for Endpoint set to Enable automatically registers each managed Windows 10/11 device with the MDE service without user interaction and also supports centralised off-boarding through Intune.

The Microsoft 365 Backup Operator role is designed for day-to-day restore operations. Members of this role can create and run restore jobs for all supported workloads and view job history and restore-point details, but they cannot change tenant-level backup configuration, create or edit backup policies, or purge backup data.

• The Backup Administrator role exceeds the requirement because it can configure backup policies and tenant settings.
• The Backup Reader role is insufficient; it provides read-only access and cannot run restores.
• The Global Reader role does not provide any Microsoft 365 Backup permissions.

Therefore, assigning the Microsoft 365 Backup Operator role delivers the required capabilities with the least privilege.

The Security operator role group in Microsoft Defender XDR lets users investigate incidents, use advanced hunting, and perform response actions-including device isolation and initiating scans-while blocking access to security settings that could change the organization's configuration. Global administrator and Security administrator can both modify security settings, while Security reader has read-only permissions and cannot take response actions.

A Temporary Access Pass (TAP) is designed to bootstrap user sign-in when no other strong credential is available. In a TAP authentication method policy you can enforce One-time use so the pass stops working after the first successful sign-in, and you can set the Default lifetime to any value between 10 minutes and 24 hours. None of the other authentication methods let you define both a single-use limitation and an explicit 10-minute validity period, so they cannot satisfy the scenario.

A file policy is designed to inspect files at rest in Microsoft 365, evaluate attributes such as sensitivity label and sharing level, and apply governance actions. By adding a condition that the file's label equals "Highly Confidential" and that sharing level is "Anyone with the link", the policy can trigger an alert and enforce a governance action. The "Put in quarantine" action moves the offending file to a secure admin-controlled location, ensuring immediate protection. Activity policies can only alert on events; they cannot quarantine files. Session policies provide real-time session controls but cannot retroactively quarantine a stored file. Anomaly detection policies are pre-defined heuristics that cannot target specific labels or guarantee quarantine.

Group Policy can only expose the Microsoft Defender for Endpoint onboarding settings after the relevant administrative templates are available. The Group Policy onboarding package contains the files WindowsDefenderATP.admx and WindowsDefenderATP.adml. Copying these files to the Central Store (SYSVOL\PolicyDefinitions) makes the Defender for Endpoint node and the onboarding setting appear in the Group Policy Management Editor. A startup script is unnecessary, the MSI installer is not used with Group Policy deployment, and disabling Microsoft Defender Antivirus would block the service required by Defender for Endpoint.

In a custom SIT pattern, proximity between the primary element and supporting evidence is controlled by the proximity value set on the supporting element. The supporting element-in this case the keyword "prototype"-requires a proximity value that specifies how many characters it can be from the primary element (the regex-based product code) for the match to be counted. Match accuracy levels are assigned to patterns, not individual elements, and an affinity marker would not provide distance logic.

To enforce device compliance or hybrid Azure AD join only when the connection originates outside the company's trusted ranges, the policy must apply to every location except those trusted ranges. The correct approach is to include All locations and then explicitly exclude the Trusted named locations. Under Grant controls, Require device to be marked as compliant OR Require hybrid Azure AD joined device enforces the device state when the policy is applied. Selecting only the trusted locations, blocking access, or requiring a password change would either ignore untrusted networks or impose the wrong control, so those options do not satisfy the scenario.