Microsoft MS-102 Hybrid Identity Preparation IdFix Connect Sync And Cloud Sync Practice Test

Practice Exams:

View All

Microsoft MS-102 Hybrid Identity Preparation IdFix Connect Sync And Cloud Sync Practice Test

MS-102 skills 2.1 | 34 original questions

This MS-102 practice set focuses on hybrid identity preparation idfix connect sync and cloud sync through original scenario-based questions aligned to Microsoft skills measured as of April 28, 2026. Use the full ExamSnap MS-102 collection for practice across all four current skill areas. For broader exam preparation, review the Microsoft MS-102 Exam Dumps page.

Instructions: Select the best answer for each question. Review the rationale after answering. Each distractor includes a brief explanation of why it is not the strongest fit for the stated scenario.

Question 1

An incident review at Margie Travel produces a single administrative requirement for the security administrator. An internal assessment finds the control technically functional but unable to identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The team will validate the change with 21 pilot groups before expanding it to 6 users. The team must preserve a clear audit trail for the administrative decision. What is the most appropriate next step?

Run IdFix against the on-premises directory before synchronization
Pilot risk-based access controls with a scoped group before broad enforcement
Use Conditional Access rather than separate ad hoc application-specific rules when a centralized access policy can express the requirement
Use Microsoft Entra Connect Health
Enable SSPR for the intended user scope

Correct answer: A

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

B: Risk-based controls can affect authentication significantly, so a scoped deployment helps validate policy behavior while reducing rollout risk. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Conditional Access provides centralized policy evaluation for Entra-authenticated applications and supports consistent access controls across the selected scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Connect Health centralizes health monitoring and alerts for supported Entra Connect components. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: SSPR can be enabled for selected groups or all eligible users and lets users reset passwords without help-desk intervention when configured requirements are met. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q001: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 2

Humongous Insurance is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. A controlled pilot must demonstrate how to prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID. The administrator must avoid granting unrelated tenant-wide privilege. The initial rollout covers 11 locations and approximately 230 managed identities or devices. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Configure the Microsoft Entra authentication methods policy
Correct duplicate or invalid identity attributes before the first sync
Use the sign-in correlation ID and failure details to trace the failed authentication
Configure Conditional Access conditions and grant controls for the required scenario
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel

Correct answer: B

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: The authentication methods policy is the central Entra control for enabling and scoping supported authentication methods. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

C: Correlation IDs and failure details help locate the precise sign-in event and avoid troubleshooting an unrelated authentication attempt. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Conditional Access combines assignments and conditions with grant or session controls to enforce context-aware access requirements. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q002: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 3

The governance lead at Wide World Importers is designing the next phase of the Microsoft 365 rollout. The administrator must choose between several Microsoft 365 controls. Only one directly meets the documented need to identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The administrator must avoid granting unrelated tenant-wide privilege. The control owner requires a review after 40 days and evidence from 24 representative cases. What is the most appropriate next step?

Use Microsoft Entra Cloud Sync with cloud provisioning agents
Review synchronization scope and filtering before recreating objects
Run IdFix against the on-premises directory before synchronization
Review Microsoft Entra sign-in logs and authentication details
Exclude emergency access accounts from policies that could block all administrators

Correct answer: C

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: OU, group, or attribute scoping can intentionally exclude objects; scope should be verified before treating absence as a data-corruption problem. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

D: Sign-in logs provide result details, authentication information, Conditional Access evaluation, and correlation data that support authentication troubleshooting. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Emergency access accounts are typically excluded from broad Conditional Access enforcement so administrators retain a recovery path. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q003: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 4

Fabrikam Health is migrating a business process to Microsoft 365 and wants the narrowest supported solution. Before the tenant expands to another business unit, the administrator must prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID. The control owner requires a review after 57 days and evidence from 14 representative cases. The change must be repeatable and supportable after the project team leaves. Which approach most directly addresses the requirement?

Confirm user compromise only when investigation supports that conclusion
Run IdFix against the on-premises directory before synchronization
Check Cloud Sync agent health and provisioning logs
Correct duplicate or invalid identity attributes before the first sync
Deploy the Microsoft Entra Password Protection proxy and DC agents for on-premises enforcement

Correct answer: D

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: Confirming compromise is a deliberate risk-state action and should be based on evidence rather than used as a generic way to clear a detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Cloud Sync troubleshooting should include the provisioning agent state and cloud provisioning logs rather than only Connect Sync tooling. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

E: On-premises Password Protection enforcement requires the supported proxy and domain-controller agents to evaluate AD DS password changes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q004: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 5

The compliance administrator at Lucerne Publishing is designing the next phase of the Microsoft 365 rollout. The next migration wave is blocked until the team can identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. The affected scope contains 74 users across 4 administrative groups. Which control should the team use?

Configure password writeback for supported hybrid SSPR scenarios
Use the Risky users and Risky sign-ins views to investigate identity risk
Use an authentication strength in Conditional Access when a specific strength of MFA is required
Check synchronization logs and the affected object attributes
Run IdFix against the on-premises directory before synchronization

Correct answer: E

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: Password writeback is required when hybrid users must have an SSPR change written back to on-premises Active Directory. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Identity Protection surfaces risky users and risky sign-ins so administrators can investigate detections and choose appropriate remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Authentication strengths let Conditional Access require stronger, explicitly allowed authentication methods when generic MFA is not sufficient. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Object-level synchronization failures are best investigated by examining sync/provisioning logs and the source attributes or rules involved. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Learning point: MS102-T07-Q005: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 6

During a tenant review at Consolidated Messenger, the hybrid identity engineer identifies one unresolved requirement. Security and operations teams agree on the target state: prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID. The architecture board will reject a choice that solves a different problem from the one stated. The initial rollout covers 17 locations and approximately 910 managed identities or devices. Which administrative choice should be recommended?

Correct duplicate or invalid identity attributes before the first sync
Use Microsoft Entra Connect Health
Enable SSPR for the intended user scope
Define how user risk and sign-in risk will trigger remediation actions
Require multifactor authentication with a Conditional Access grant control

Correct answer: A

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

B: Connect Health centralizes health monitoring and alerts for supported Entra Connect components. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: SSPR can be enabled for selected groups or all eligible users and lets users reset passwords without help-desk intervention when configured requirements are met. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Identity Protection planning should connect detected risk levels to actions such as secure password change, MFA, or blocking according to organizational risk policy. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: A Conditional Access policy can require MFA as a grant control so the additional factor is enforced only for the intended policy scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q006: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 7

Margie Travel is migrating a business process to Microsoft 365 and wants the narrowest supported solution. The next migration wave is blocked until the team can identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The response must address the cause described in the scenario rather than simply suppressing the symptom. The control owner requires a review after 17 days and evidence from 7 representative cases. What should the administrator configure first?

Configure Conditional Access conditions and grant controls for the required scenario
Run IdFix against the on-premises directory before synchronization
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel
Use a phishing-resistant authentication method such as passkeys or FIDO2 security keys when the requirement demands phishing resistance
Pilot risk-based access controls with a scoped group before broad enforcement

Correct answer: B

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: Conditional Access combines assignments and conditions with grant or session controls to enforce context-aware access requirements. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

C: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Phishing-resistant methods use cryptographic authentication that is not satisfied by replaying a stolen password or simple OTP in a phishing flow. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Risk-based controls can affect authentication significantly, so a scoped deployment helps validate policy behavior while reducing rollout risk. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q007: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 8

Wide World Importers is migrating a business process to Microsoft 365 and wants the narrowest supported solution. Administrators have confirmed the present design does not prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID. The control owner requires a review after 34 days and evidence from 20 representative cases. The administrator must avoid granting unrelated tenant-wide privilege. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Review Microsoft Entra sign-in logs and authentication details
Exclude emergency access accounts from policies that could block all administrators
Correct duplicate or invalid identity attributes before the first sync
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Configure the Microsoft Entra authentication methods policy

Correct answer: C

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: Sign-in logs provide result details, authentication information, Conditional Access evaluation, and correlation data that support authentication troubleshooting. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Emergency access accounts are typically excluded from broad Conditional Access enforcement so administrators retain a recovery path. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

D: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: The authentication methods policy is the central Entra control for enabling and scoping supported authentication methods. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q008: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 9

An incident review at Trey Research produces a single administrative requirement for the messaging administrator. The next migration wave is blocked until the team can identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The response must address the cause described in the scenario rather than simply suppressing the symptom. The affected scope contains 51 users across 10 administrative groups. What should the administrator configure first?

Check Cloud Sync agent health and provisioning logs
Deploy the Microsoft Entra Password Protection proxy and DC agents for on-premises enforcement
Start a new Conditional Access policy in report-only mode
Run IdFix against the on-premises directory before synchronization
Use Microsoft Entra Cloud Sync with cloud provisioning agents

Correct answer: D

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: Cloud Sync troubleshooting should include the provisioning agent state and cloud provisioning logs rather than only Connect Sync tooling. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: On-premises Password Protection enforcement requires the supported proxy and domain-controller agents to evaluate AD DS password changes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Report-only mode lets administrators assess policy impact and sign-in results without immediately blocking or challenging users. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

E: Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q009: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 10

An incident review at Trey Research produces a single administrative requirement for the compliance administrator. The administrator must choose between several Microsoft 365 controls. Only one directly meets the documented need to prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID. Existing workload settings should remain unchanged unless the requirement specifically depends on them. The control owner requires a review after 68 days and evidence from 23 representative cases. Which option best satisfies the requirement?

Use an authentication strength in Conditional Access when a specific strength of MFA is required
Check synchronization logs and the affected object attributes
Configure the custom banned password list in Microsoft Entra Password Protection
Confirm user compromise only when investigation supports that conclusion
Correct duplicate or invalid identity attributes before the first sync

Correct answer: E

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: Authentication strengths let Conditional Access require stronger, explicitly allowed authentication methods when generic MFA is not sufficient. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Object-level synchronization failures are best investigated by examining sync/provisioning logs and the source attributes or rules involved. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Custom banned passwords supplement global protection by blocking tenant-specific words that attackers could easily guess. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Confirming compromise is a deliberate risk-state action and should be based on evidence rather than used as a generic way to clear a detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Learning point: MS102-T07-Q010: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 11

A quarterly control review at Datum Dynamics identifies a gap that must be corrected before the next audit. Audit evidence shows that the current process cannot reliably identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The organization wants a reversible rollout with measurable verification before broad enforcement. The affected scope contains 85 users across 13 administrative groups. What should the administrator configure first?

Run IdFix against the on-premises directory before synchronization
Define how user risk and sign-in risk will trigger remediation actions
Require multifactor authentication with a Conditional Access grant control
Investigate a synchronization health alert in Microsoft Entra Connect Health
Configure password writeback for supported hybrid SSPR scenarios

Correct answer: A

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

B: Identity Protection planning should connect detected risk levels to actions such as secure password change, MFA, or blocking according to organizational risk policy. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: A Conditional Access policy can require MFA as a grant control so the additional factor is enforced only for the intended policy scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Connect Health surfaces health and alert information that helps administrators distinguish service or agent problems from configuration issues. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Password writeback is required when hybrid users must have an SSPR change written back to on-premises Active Directory. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q011: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 12

The operations team at Blue Yonder Airlines needs to resolve an issue without granting broader permissions than necessary. The administrator is comparing native Microsoft controls after documenting a requirement to prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID. The control owner requires a review after 11 days and evidence from 3 representative cases. The change must be repeatable and supportable after the project team leaves. Which approach most directly addresses the requirement?

Use a phishing-resistant authentication method such as passkeys or FIDO2 security keys when the requirement demands phishing resistance
Correct duplicate or invalid identity attributes before the first sync
Pilot risk-based access controls with a scoped group before broad enforcement
Use Conditional Access rather than separate ad hoc application-specific rules when a centralized access policy can express the requirement
Use Microsoft Entra Connect Health

Correct answer: B

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: Phishing-resistant methods use cryptographic authentication that is not satisfied by replaying a stolen password or simple OTP in a phishing flow. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

C: Risk-based controls can affect authentication significantly, so a scoped deployment helps validate policy behavior while reducing rollout risk. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Conditional Access provides centralized policy evaluation for Entra-authenticated applications and supports consistent access controls across the selected scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Connect Health centralizes health monitoring and alerts for supported Entra Connect components. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q012: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 13

During a tenant review at Alpine Ski House, the compliance administrator identifies one unresolved requirement. A controlled pilot must demonstrate how to identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The response must address the cause described in the scenario rather than simply suppressing the symptom. The service desk has 28 related tickets from 16 business units, so the team wants a targeted fix. Which approach most directly addresses the requirement?

Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Configure the Microsoft Entra authentication methods policy
Run IdFix against the on-premises directory before synchronization
Use the sign-in correlation ID and failure details to trace the failed authentication
Configure Conditional Access conditions and grant controls for the required scenario

Correct answer: C

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: The authentication methods policy is the central Entra control for enabling and scoping supported authentication methods. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

D: Correlation IDs and failure details help locate the precise sign-in event and avoid troubleshooting an unrelated authentication attempt. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Conditional Access combines assignments and conditions with grant or session controls to enforce context-aware access requirements. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q013: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 14

Litware Financial has completed a pilot and must now choose the production administration approach. A production change is approved only if it can prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID. The organization wants a reversible rollout with measurable verification before broad enforcement. The affected scope contains 45 users across 6 administrative groups. Which approach most directly addresses the requirement?

Start a new Conditional Access policy in report-only mode
Use Microsoft Entra Cloud Sync with cloud provisioning agents
Review synchronization scope and filtering before recreating objects
Correct duplicate or invalid identity attributes before the first sync
Review Microsoft Entra sign-in logs and authentication details

Correct answer: D

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: Report-only mode lets administrators assess policy impact and sign-in results without immediately blocking or challenging users. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: OU, group, or attribute scoping can intentionally exclude objects; scope should be verified before treating absence as a data-corruption problem. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

E: Sign-in logs provide result details, authentication information, Conditional Access evaluation, and correlation data that support authentication troubleshooting. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q014: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 15

The operations team at Datum Dynamics needs to resolve an issue without granting broader permissions than necessary. A controlled pilot must demonstrate how to identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The architecture board will reject a choice that solves a different problem from the one stated. The service desk has 62 related tickets from 19 business units, so the team wants a targeted fix. Which action should the administrator take?

Configure the custom banned password list in Microsoft Entra Password Protection
Confirm user compromise only when investigation supports that conclusion
Correct duplicate or invalid identity attributes before the first sync
Check Cloud Sync agent health and provisioning logs
Run IdFix against the on-premises directory before synchronization

Correct answer: E

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: Custom banned passwords supplement global protection by blocking tenant-specific words that attackers could easily guess. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Confirming compromise is a deliberate risk-state action and should be based on evidence rather than used as a generic way to clear a detection. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Cloud Sync troubleshooting should include the provisioning agent state and cloud provisioning logs rather than only Connect Sync tooling. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Learning point: MS102-T07-Q015: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 16

Fabrikam Health is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. The organization is replacing a manual process. The replacement must prevent known on-premises directory data quality problems from propagating into Microsoft Entra ID while remaining centrally manageable. The initial rollout covers 9 locations and approximately 790 managed identities or devices. The organization wants a reversible rollout with measurable verification before broad enforcement. What is the most appropriate next step?

Correct duplicate or invalid identity attributes before the first sync
Investigate a synchronization health alert in Microsoft Entra Connect Health
Configure password writeback for supported hybrid SSPR scenarios
Use the Risky users and Risky sign-ins views to investigate identity risk
Use an authentication strength in Conditional Access when a specific strength of MFA is required

Correct answer: A

Why: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

Option review:

A: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. It directly addresses the stated requirement.

B: Connect Health surfaces health and alert information that helps administrators distinguish service or agent problems from configuration issues. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Password writeback is required when hybrid users must have an SSPR change written back to on-premises Active Directory. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Identity Protection surfaces risky users and risky sign-ins so administrators can investigate detections and choose appropriate remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Authentication strengths let Conditional Access require stronger, explicitly allowed authentication methods when generic MFA is not sufficient. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q016: Correct duplicate or invalid identity attributes before the first sync – Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts.

Question 17

The operations team at Proseware Logistics needs to resolve an issue without granting broader permissions than necessary. The service owner wants a supportable design that will identify directory attribute problems such as duplicates or formatting issues before enabling synchronization. The organization wants a reversible rollout with measurable verification before broad enforcement. The initial rollout covers 22 locations and approximately 50 managed identities or devices. Which approach most directly addresses the requirement?

Use Conditional Access rather than separate ad hoc application-specific rules when a centralized access policy can express the requirement
Run IdFix against the on-premises directory before synchronization
Use Microsoft Entra Connect Health
Enable SSPR for the intended user scope
Define how user risk and sign-in risk will trigger remediation actions

Correct answer: B

Why: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

Option review:

A: Conditional Access provides centralized policy evaluation for Entra-authenticated applications and supports consistent access controls across the selected scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. It directly addresses the stated requirement.

C: Connect Health centralizes health monitoring and alerts for supported Entra Connect components. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: SSPR can be enabled for selected groups or all eligible users and lets users reset passwords without help-desk intervention when configured requirements are met. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Identity Protection planning should connect detected risk levels to actions such as secure password change, MFA, or blocking according to organizational risk policy. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q017: Run IdFix against the on-premises directory before synchronization – IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems.

Question 18

During a tenant review at Woodgrove Bank, the hybrid identity engineer identifies one unresolved requirement. The service owner wants a supportable design that will synchronize supported directory objects using lightweight agents with cloud-managed synchronization configuration. The response must address the cause described in the scenario rather than simply suppressing the symptom. The affected scope contains 22 users across 12 administrative groups. Which option best satisfies the requirement?

Use the sign-in correlation ID and failure details to trace the failed authentication
Configure Conditional Access conditions and grant controls for the required scenario
Use Microsoft Entra Cloud Sync with cloud provisioning agents
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel
Use a phishing-resistant authentication method such as passkeys or FIDO2 security keys when the requirement demands phishing resistance

Correct answer: C

Why: Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments. It directly addresses the stated requirement.

Option review:

A: Correlation IDs and failure details help locate the precise sign-in event and avoid troubleshooting an unrelated authentication attempt. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Conditional Access combines assignments and conditions with grant or session controls to enforce context-aware access requirements. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments. It directly addresses the stated requirement.

D: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Phishing-resistant methods use cryptographic authentication that is not satisfied by replaying a stolen password or simple OTP in a phishing flow. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q018: Use Microsoft Entra Cloud Sync with cloud provisioning agents – Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments.

Question 19

An incident review at A. Datum Manufacturing produces a single administrative requirement for the identity administrator. A post-incident action item requires the tenant to retain synchronization functionality that requires the full Connect Sync engine. The affected scope contains 39 users across 2 administrative groups. The organization wants a reversible rollout with measurable verification before broad enforcement. Which option best satisfies the requirement?

Review synchronization scope and filtering before recreating objects
Review Microsoft Entra sign-in logs and authentication details
Exclude emergency access accounts from policies that could block all administrators
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Use Microsoft Entra Cloud Sync with cloud provisioning agents

Correct answer: D

Why: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Option review:

A: OU, group, or attribute scoping can intentionally exclude objects; scope should be verified before treating absence as a data-corruption problem. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Sign-in logs provide result details, authentication information, Conditional Access evaluation, and correlation data that support authentication troubleshooting. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Emergency access accounts are typically excluded from broad Conditional Access enforcement so administrators retain a recovery path. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Learning point: MS102-T07-Q019: Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync – Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set.

Question 20

An incident review at Margie Travel produces a single administrative requirement for the tenant administrator. The change advisory board wants the smallest supported control that can avoid having both synchronization engines manage the same objects or attributes unexpectedly. The initial rollout covers 15 locations and approximately 560 managed identities or devices. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. Which administrative choice should be recommended?

Run IdFix against the on-premises directory before synchronization
Check Cloud Sync agent health and provisioning logs
Deploy the Microsoft Entra Password Protection proxy and DC agents for on-premises enforcement
Start a new Conditional Access policy in report-only mode
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel

Correct answer: E

Why: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

Option review:

A: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Cloud Sync troubleshooting should include the provisioning agent state and cloud provisioning logs rather than only Connect Sync tooling. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: On-premises Password Protection enforcement requires the supported proxy and domain-controller agents to evaluate AD DS password changes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Report-only mode lets administrators assess policy impact and sign-in results without immediately blocking or challenging users. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

Learning point: MS102-T07-Q020: Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel – Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes.

Question 21

A quarterly control review at Tailspin Toys identifies a gap that must be corrected before the next audit. Administrators have confirmed the present design does not synchronize supported directory objects using lightweight agents with cloud-managed synchronization configuration. The team will validate the change with 5 pilot groups before expanding it to 73 users. The administrator must avoid granting unrelated tenant-wide privilege. Which administrative choice should be recommended?

Use Microsoft Entra Cloud Sync with cloud provisioning agents
Use the Risky users and Risky sign-ins views to investigate identity risk
Use an authentication strength in Conditional Access when a specific strength of MFA is required
Check synchronization logs and the affected object attributes
Configure the custom banned password list in Microsoft Entra Password Protection

Correct answer: A

Option review:

E: Custom banned passwords supplement global protection by blocking tenant-specific words that attackers could easily guess. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q021: Use Microsoft Entra Cloud Sync with cloud provisioning agents – Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments.

Question 22

Datum Manufacturing is standardizing administration after several teams used inconsistent procedures. Audit evidence shows that the current process cannot reliably retain synchronization functionality that requires the full Connect Sync engine. Existing workload settings should remain unchanged unless the requirement specifically depends on them. The service desk has 90 related tickets from 18 business units, so the team wants a targeted fix. What should the administrator configure first?
Enable SSPR for the intended user scope
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Define how user risk and sign-in risk will trigger remediation actions
Require multifactor authentication with a Conditional Access grant control
Investigate a synchronization health alert in Microsoft Entra Connect Health

Correct answer: B

Why: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Option review:

A: SSPR can be enabled for selected groups or all eligible users and lets users reset passwords without help-desk intervention when configured requirements are met. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

C: Identity Protection planning should connect detected risk levels to actions such as secure password change, MFA, or blocking according to organizational risk policy. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: A Conditional Access policy can require MFA as a grant control so the additional factor is enforced only for the intended policy scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Connect Health surfaces health and alert information that helps administrators distinguish service or agent problems from configuration issues. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q022: Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync – Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set.

Question 23

Wingtip Services is migrating a business process to Microsoft 365 and wants the narrowest supported solution. The implementation review is focused on one outcome: avoid having both synchronization engines manage the same objects or attributes unexpectedly. The team will validate the change with 8 pilot groups before expanding it to 16 users. The team does not want to redesign unrelated workloads. Which administrative choice should be recommended?

Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Use a phishing-resistant authentication method such as passkeys or FIDO2 security keys when the requirement demands phishing resistance
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel
Pilot risk-based access controls with a scoped group before broad enforcement
Use Conditional Access rather than separate ad hoc application-specific rules when a centralized access policy can express the requirement

Correct answer: C

Why: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

Option review:

B: Phishing-resistant methods use cryptographic authentication that is not satisfied by replaying a stolen password or simple OTP in a phishing flow. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

D: Risk-based controls can affect authentication significantly, so a scoped deployment helps validate policy behavior while reducing rollout risk. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Conditional Access provides centralized policy evaluation for Entra-authenticated applications and supports consistent access controls across the selected scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q023: Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel – Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes.

Question 24

Blue Yonder Airlines is standardizing administration after several teams used inconsistent procedures. The project board will approve the next step only if it can synchronize supported directory objects using lightweight agents with cloud-managed synchronization configuration. The team will validate the change with 21 pilot groups before expanding it to 33 users. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. Which option best satisfies the requirement?

Exclude emergency access accounts from policies that could block all administrators
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Configure the Microsoft Entra authentication methods policy
Use Microsoft Entra Cloud Sync with cloud provisioning agents
Use the sign-in correlation ID and failure details to trace the failed authentication

Correct answer: D

Option review:

A: Emergency access accounts are typically excluded from broad Conditional Access enforcement so administrators retain a recovery path. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: The authentication methods policy is the central Entra control for enabling and scoping supported authentication methods. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments. It directly addresses the stated requirement.

E: Correlation IDs and failure details help locate the precise sign-in event and avoid troubleshooting an unrelated authentication attempt. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q024: Use Microsoft Entra Cloud Sync with cloud provisioning agents – Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments.

Question 25

Datum Manufacturing has completed a pilot and must now choose the production administration approach. The organization is replacing a manual process. The replacement must retain synchronization functionality that requires the full Connect Sync engine while remaining centrally manageable. The affected scope contains 50 users across 11 administrative groups. The architecture board will reject a choice that solves a different problem from the one stated. Which approach most directly addresses the requirement?
Deploy the Microsoft Entra Password Protection proxy and DC agents for on-premises enforcement
Start a new Conditional Access policy in report-only mode
Correct duplicate or invalid identity attributes before the first sync
Review synchronization scope and filtering before recreating objects
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync

Correct answer: E

Why: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Option review:

A: On-premises Password Protection enforcement requires the supported proxy and domain-controller agents to evaluate AD DS password changes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Report-only mode lets administrators assess policy impact and sign-in results without immediately blocking or challenging users. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: OU, group, or attribute scoping can intentionally exclude objects; scope should be verified before treating absence as a data-corruption problem. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Learning point: MS102-T07-Q025: Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync – Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set.

Question 26

Datum Dynamics is migrating a business process to Microsoft 365 and wants the narrowest supported solution. The existing configuration works for normal operations but fails the new requirement to avoid having both synchronization engines manage the same objects or attributes unexpectedly. The architecture board will reject a choice that solves a different problem from the one stated. The initial rollout covers 24 locations and approximately 670 managed identities or devices. Which approach most directly addresses the requirement?

Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel
Check synchronization logs and the affected object attributes
Configure the custom banned password list in Microsoft Entra Password Protection
Confirm user compromise only when investigation supports that conclusion
Run IdFix against the on-premises directory before synchronization

Correct answer: A

Why: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

Option review:

A: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

E: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q026: Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel – Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes.

Question 27

Graphic Design Institute is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. The change advisory board wants the smallest supported control that can synchronize supported directory objects using lightweight agents with cloud-managed synchronization configuration. The initial rollout covers 14 locations and approximately 840 managed identities or devices. The design should minimize manual per-user administration where a scoped central control exists. Which approach most directly addresses the requirement?

Require multifactor authentication with a Conditional Access grant control
Use Microsoft Entra Cloud Sync with cloud provisioning agents
Investigate a synchronization health alert in Microsoft Entra Connect Health
Configure password writeback for supported hybrid SSPR scenarios
Use the Risky users and Risky sign-ins views to investigate identity risk

Correct answer: B

Option review:

A: A Conditional Access policy can require MFA as a grant control so the additional factor is enforced only for the intended policy scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Connect Health surfaces health and alert information that helps administrators distinguish service or agent problems from configuration issues. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Password writeback is required when hybrid users must have an SSPR change written back to on-premises Active Directory. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Identity Protection surfaces risky users and risky sign-ins so administrators can investigate detections and choose appropriate remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q027: Use Microsoft Entra Cloud Sync with cloud provisioning agents – Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments.

Question 28

Fabrikam Health is standardizing administration after several teams used inconsistent procedures. A production change is approved only if it can retain synchronization functionality that requires the full Connect Sync engine. The change must be repeatable and supportable after the project team leaves. The initial rollout covers 4 locations and approximately 100 managed identities or devices. Which option best satisfies the requirement?

Pilot risk-based access controls with a scoped group before broad enforcement
Use Conditional Access rather than separate ad hoc application-specific rules when a centralized access policy can express the requirement
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Use Microsoft Entra Connect Health
Enable SSPR for the intended user scope

Correct answer: C

Why: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Option review:

A: Risk-based controls can affect authentication significantly, so a scoped deployment helps validate policy behavior while reducing rollout risk. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: Conditional Access provides centralized policy evaluation for Entra-authenticated applications and supports consistent access controls across the selected scope. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Learning point: MS102-T07-Q028: Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync – Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set.

Question 29

A quarterly control review at Contoso Retail identifies a gap that must be corrected before the next audit. The administrator is comparing native Microsoft controls after documenting a requirement to avoid having both synchronization engines manage the same objects or attributes unexpectedly. The initial rollout covers 17 locations and approximately 270 managed identities or devices. The solution should use a native Microsoft control that matches the stated requirement. What should the administrator configure first?

Configure the Microsoft Entra authentication methods policy
Use the sign-in correlation ID and failure details to trace the failed authentication
Configure Conditional Access conditions and grant controls for the required scenario
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync

Correct answer: D

Why: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

Option review:

B: Correlation IDs and failure details help locate the precise sign-in event and avoid troubleshooting an unrelated authentication attempt. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Conditional Access combines assignments and conditions with grant or session controls to enforce context-aware access requirements. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

E: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q029: Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel – Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes.

Question 30

City Power & Light is troubleshooting a Microsoft 365 behavior that affects a limited but important user population. Before the tenant expands to another business unit, the administrator must synchronize supported directory objects using lightweight agents with cloud-managed synchronization configuration. The initial rollout covers 7 locations and approximately 440 managed identities or devices. The solution should use a native Microsoft control that matches the stated requirement. What should the administrator configure first?

Correct duplicate or invalid identity attributes before the first sync
Review synchronization scope and filtering before recreating objects
Review Microsoft Entra sign-in logs and authentication details
Exclude emergency access accounts from policies that could block all administrators
Use Microsoft Entra Cloud Sync with cloud provisioning agents

Correct answer: E

Option review:

A: Preparing the directory before synchronization reduces avoidable provisioning errors and object conflicts. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Sign-in logs provide result details, authentication information, Conditional Access evaluation, and correlation data that support authentication troubleshooting. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Emergency access accounts are typically excluded from broad Conditional Access enforcement so administrators retain a recovery path. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q030: Use Microsoft Entra Cloud Sync with cloud provisioning agents – Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments.

Question 31

The operations team at Southridge Video needs to resolve an issue without granting broader permissions than necessary. The project board will approve the next step only if it can retain synchronization functionality that requires the full Connect Sync engine. The team will validate the change with 20 pilot groups before expanding it to 61 users. The response must address the cause described in the scenario rather than simply suppressing the symptom. Which administrative choice should be recommended?

Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Confirm user compromise only when investigation supports that conclusion
Run IdFix against the on-premises directory before synchronization
Check Cloud Sync agent health and provisioning logs
Deploy the Microsoft Entra Password Protection proxy and DC agents for on-premises enforcement

Correct answer: A

Why: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Option review:

A: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

C: IdFix is intended to detect and help remediate directory attributes that can cause synchronization or Microsoft 365 identity problems. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q031: Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync – Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set.

Question 32

An incident review at Trey Research produces a single administrative requirement for the compliance administrator. Before the tenant expands to another business unit, the administrator must avoid having both synchronization engines manage the same objects or attributes unexpectedly. The team will validate the change with 10 pilot groups before expanding it to 78 users. The administrator must avoid granting unrelated tenant-wide privilege. What should the administrator configure first?

Configure password writeback for supported hybrid SSPR scenarios
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel
Use the Risky users and Risky sign-ins views to investigate identity risk
Use an authentication strength in Conditional Access when a specific strength of MFA is required
Check synchronization logs and the affected object attributes

Correct answer: B

Why: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

Option review:

B: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. It directly addresses the stated requirement.

C: Identity Protection surfaces risky users and risky sign-ins so administrators can investigate detections and choose appropriate remediation. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Authentication strengths let Conditional Access require stronger, explicitly allowed authentication methods when generic MFA is not sufficient. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

E: Object-level synchronization failures are best investigated by examining sync/provisioning logs and the source attributes or rules involved. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q032: Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel – Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes.

Question 33

During a tenant review at Fabrikam Health, the security administrator identifies one unresolved requirement. An internal assessment finds the control technically functional but unable to synchronize supported directory objects using lightweight agents with cloud-managed synchronization configuration. The team will validate the change with 23 pilot groups before expanding it to 95 users. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. Which Microsoft 365 or Microsoft Entra capability is the best fit?

Use Microsoft Entra Connect Health
Enable SSPR for the intended user scope
Use Microsoft Entra Cloud Sync with cloud provisioning agents
Define how user risk and sign-in risk will trigger remediation actions
Require multifactor authentication with a Conditional Access grant control

Correct answer: C

Option review:

A: Connect Health centralizes health monitoring and alerts for supported Entra Connect components. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

B: SSPR can be enabled for selected groups or all eligible users and lets users reset passwords without help-desk intervention when configured requirements are met. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

Learning point: MS102-T07-Q033: Use Microsoft Entra Cloud Sync with cloud provisioning agents – Cloud Sync uses cloud provisioning agents and cloud-managed configuration, making it suitable for supported hybrid identity scenarios and distributed agent deployments.

Question 34

During a tenant review at Contoso Retail, the Microsoft 365 administrator identifies one unresolved requirement. The next migration wave is blocked until the team can retain synchronization functionality that requires the full Connect Sync engine. The team wants evidence from the Microsoft 365 or Microsoft Entra control plane rather than assumptions. The affected scope contains 21 users across 13 administrative groups. Which control should the team use?

Configure Conditional Access conditions and grant controls for the required scenario
Use mutually exclusive scoping if Connect Sync and Cloud Sync run in parallel
Use a phishing-resistant authentication method such as passkeys or FIDO2 security keys when the requirement demands phishing resistance
Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync
Pilot risk-based access controls with a scoped group before broad enforcement

Correct answer: D

Why: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Option review:

B: Parallel synchronization can be used in supported scenarios, but scoping must prevent conflicting management of the same objects or attributes. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

C: Phishing-resistant methods use cryptographic authentication that is not satisfied by replaying a stolen password or simple OTP in a phishing flow. That capability can be valid in its own scenario, but it does not most directly satisfy the requirement stated here.

D: Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set. It directly addresses the stated requirement.

Learning point: MS102-T07-Q034: Use Microsoft Entra Connect Sync when the required scenario depends on a feature not yet supported by Cloud Sync – Connect Sync remains appropriate when a required hybrid identity capability is outside the supported Cloud Sync feature set.

Related posts: