Practice Exams:

View All

Microsoft 365 Copilot AB-900 Microsoft Entra ID Conditional Access And Single Sign On Practice Test

Skills 1.3 • 30 original questions

This Microsoft AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals practice test focuses on microsoft entra id conditional access and single sign on through original scenario-based questions aligned to the Skills measured as of July 22, 2026. Use the full ExamSnap AB-900 collection for broader practice across all current skill areas. For broader exam preparation, review the Microsoft AB-900 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

An administrator reviewing service desk escalation for Trey Research must manage cloud identities and access for Microsoft 365. Which Microsoft 365 control or object should be used? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use the Teams admin center and configure the relevant team, channel, or Teams policy

Correct answer: C

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

B: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

C: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

D: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Learning point: Use Microsoft Entra ID for cloud identity, authentication, and access management. Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls.

Question 2

A design review at Consolidated Messenger identifies one specific goal: block access when sign-in risk or device conditions violate policy. Which option best matches that goal? The team needs a direct administrative answer, not a broad redesign.

Use the Exchange admin center to configure the required mailbox or distribution group
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity

Correct answer: D

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

B: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

C: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

E: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

Learning point: Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control. Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access.

Question 3

The IT team at Woodgrove Bank wants to explain the user-experience benefit of federated or centrally managed authentication. Which Microsoft 365 capability should it use? The administrator wants an action that is easy to audit later.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity

Correct answer: A

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

B: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

C: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

D: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Learning point: Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials. SSO improves usability and can centralize authentication while maintaining application authorization decisions.

Question 4

Wide World Importers is documenting its administrative model. Which choice most accurately describes the capability needed to manage cloud identities and access for Microsoft 365? The solution should preserve least privilege and existing governance where possible.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use the Exchange admin center to configure the required mailbox or distribution group

Correct answer: B

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

B: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

C: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 5

During a agent governance review at Southridge Video, the compliance administrator must block access when sign-in risk or device conditions violate policy. Which Microsoft 365 action or concept most directly satisfies the requirement? The team wants the smallest change that directly addresses the requirement.

Use the Exchange admin center to configure the required mailbox or distribution group
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control

Correct answer: E

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

B: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

C: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Question 6

Fabrikam is preparing a data protection review. The team needs to explain the user-experience benefit of federated or centrally managed authentication. What should the IT administrator choose? The decision must address the stated requirement rather than a different Microsoft 365 control.

Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use the Exchange admin center to configure the required mailbox or distribution group
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO

Correct answer: B

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

B: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

C: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

D: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 7

A support case at Wingtip Toys says administrators must manage cloud identities and access for Microsoft 365. Which option is the best fit? The team will validate the result immediately after the change.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: A

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

B: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

C: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 8

VanArsdel is documenting its administrative model. Which choice most accurately describes the capability needed to block access when sign-in risk or device conditions violate policy? No unrelated tenant settings should be changed.

Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: B

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

B: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

C: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

Question 9

The Microsoft 365 administrator at Bellows College is asked to explain the user-experience benefit of federated or centrally managed authentication. What is the most appropriate next step? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity

Correct answer: C

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

B: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

C: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 10

Tailspin Toys has validated the surrounding services. The remaining requirement is to manage cloud identities and access for Microsoft 365. Which choice is correct? The choice should follow normal Microsoft 365 administrative practice.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use the Teams admin center and configure the relevant team, channel, or Teams policy

Correct answer: A

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

B: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

C: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 11

An administrator reviewing tenant cleanup for Coho Winery must block access when sign-in risk or device conditions violate policy. Which Microsoft 365 control or object should be used? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use the Exchange admin center to configure the required mailbox or distribution group
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control

Correct answer: E

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

B: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Question 12

Humongous Insurance is documenting its administrative model. Which choice most accurately describes the capability needed to explain the user-experience benefit of federated or centrally managed authentication? The team needs a direct administrative answer, not a broad redesign.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials

Correct answer: E

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

B: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

C: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

D: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Question 13

The IT team at Adventure Works wants to manage cloud identities and access for Microsoft 365. Which Microsoft 365 capability should it use? The administrator wants an action that is easy to audit later.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Evaluate authorization after authentication to determine what the identity is allowed to access or do

Correct answer: A

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

B: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

C: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 14

While handling a new-user onboarding, the IT administrator needs to block access when sign-in risk or device conditions violate policy. Which answer most directly addresses the stated need? The solution should preserve least privilege and existing governance where possible.

Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control

Correct answer: E

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

B: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

C: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Question 15

During a oversharing investigation at Relecloud, the identity administrator must explain the user-experience benefit of federated or centrally managed authentication. Which Microsoft 365 action or concept most directly satisfies the requirement? The team wants the smallest change that directly addresses the requirement.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use the Teams admin center and configure the relevant team, channel, or Teams policy

Correct answer: A

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

B: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

C: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

D: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 16

Lamna Healthcare is documenting its administrative model. Which choice most accurately describes the capability needed to manage cloud identities and access for Microsoft 365? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach

Correct answer: A

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

B: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

C: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 17

A support case at Proseware says administrators must block access when sign-in risk or device conditions violate policy. Which option is the best fit? The team will validate the result immediately after the change.

Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use the Exchange admin center to configure the required mailbox or distribution group
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control

Correct answer: E

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

D: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Question 18

For a security review at Lucerne Publishing, which Microsoft 365 approach correctly addresses the need to explain the user-experience benefit of federated or centrally managed authentication? No unrelated tenant settings should be changed.

Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use the Exchange admin center to configure the required mailbox or distribution group
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Evaluate authorization after authentication to determine what the identity is allowed to access or do

Correct answer: B

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

B: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

D: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 19

The service desk lead at City Power & Light is asked to manage cloud identities and access for Microsoft 365. What is the most appropriate next step? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use the Exchange admin center to configure the required mailbox or distribution group
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity

Correct answer: C

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

B: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

C: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

D: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 20

Northwind Traders is documenting its administrative model. Which choice most accurately describes the capability needed to block access when sign-in risk or device conditions violate policy? The choice should follow normal Microsoft 365 administrative practice.

Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads

Correct answer: D

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

C: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

E: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

Question 21

An administrator reviewing data protection review for Fourth Coffee must explain the user-experience benefit of federated or centrally managed authentication. Which Microsoft 365 control or object should be used? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads

Correct answer: B

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

B: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

C: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

D: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 22

A design review at Alpine Ski House identifies one specific goal: manage cloud identities and access for Microsoft 365. Which option best matches that goal? The team needs a direct administrative answer, not a broad redesign.

Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use Microsoft Entra ID for cloud identity, authentication, and access management

Correct answer: E

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

C: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Question 23

The IT team at Contoso wants to block access when sign-in risk or device conditions violate policy. Which Microsoft 365 capability should it use? The administrator wants an action that is easy to audit later.

Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control

Correct answer: E

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

B: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

C: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Question 24

Litware is documenting its administrative model. Which choice most accurately describes the capability needed to explain the user-experience benefit of federated or centrally managed authentication? The solution should preserve least privilege and existing governance where possible.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: A

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

B: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

C: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 25

During a pilot rollout at Trey Research, the Microsoft 365 administrator must manage cloud identities and access for Microsoft 365. Which Microsoft 365 action or concept most directly satisfies the requirement? The team wants the smallest change that directly addresses the requirement.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO

Correct answer: A

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

C: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

E: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 26

Consolidated Messenger is preparing a tenant cleanup. The team needs to block access when sign-in risk or device conditions violate policy. What should the security administrator choose? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use the Teams admin center and configure the relevant team, channel, or Teams policy
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control

Correct answer: E

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

B: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

C: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Question 27

A support case at Woodgrove Bank says administrators must explain the user-experience benefit of federated or centrally managed authentication. Which option is the best fit? The team will validate the result immediately after the change.

Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach

Correct answer: B

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

B: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

C: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

D: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 28

Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use Microsoft Entra ID for cloud identity, authentication, and access management
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement

Correct answer: D

Why: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

Option review:

A: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

B: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

D: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This directly addresses the stated requirement.

E: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to manage cloud identities and access for Microsoft 365.

Question 29

The compliance administrator at Southridge Video is asked to block access when sign-in risk or device conditions violate policy. What is the most appropriate next step? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use the Exchange admin center to configure the required mailbox or distribution group
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control

Correct answer: E

Why: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Option review:

A: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

C: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

D: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to block access when sign-in risk or device conditions violate policy.

E: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This directly addresses the stated requirement.

Question 30

Fabrikam has validated the surrounding services. The remaining requirement is to explain the user-experience benefit of federated or centrally managed authentication. Which choice is correct? The choice should follow normal Microsoft 365 administrative practice.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: A

Why: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

Option review:

A: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This directly addresses the stated requirement.

B: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

C: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

D: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

E: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain the user-experience benefit of federated or centrally managed authentication.

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Related posts: