Microsoft AZ-104 Exam Dumps, Practice Test Questions

Revoking sign-in sessions is appropriate for invalidating Entra refresh tokens after device theft, but it does not change the account-enabled state. Because this leave requires preventing all new sign-ins until an administrator intentionally re-enables the identity, the user could simply authenticate again while the account remains enabled. Session revocation is an accompanying containment measure, not the required persistent block.

Requiring a password change at the next sign-in can protect an account after suspected credential disclosure, but the account remains enabled and the user may complete that interactive change and sign in. It does not provide the persistent account suspension required during leave. The organization instead needs a reversible disabled sign-in state while retaining the original identity.

Removing a Microsoft 365 license may stop use of applications entitled by that SKU, but licensing is not the universal sign-in switch for Microsoft Entra. The employee could still authenticate to the directory or to other licensed and federated applications. It also unnecessarily changes entitlements the organization wants to preserve; disabling sign-in directly targets authentication.

A B2B invitation creates an external collaboration identity rather than restoring the original workforce account. It would not recover the deleted object ID and original account relationships.

A display name is not an immutable directory identity. Creating another user does not recreate the deleted object and can leave previous memberships and references broken.

Recreating a separate identity and attaching resource roles does not restore the original Entra object, its historical object ID, or directory relationships. The original deleted identity remains recoverable during the supported window.

Preferred data location is a workload residency preference for supported multi-geo services, not the identity property that license assignment uses to determine regional service availability. A user can have an appropriate data-residency setting and still lack the required Usage location for a direct Microsoft 365 license assignment. Populate the actual usageLocation property rather than a neighboring geographic attribute.

Office location is an informational directory profile field that may describe the workplace or building. It does not substitute for the licensing Usage location check, even if both happen to contain the same country. Editing this profile value would leave the explicit prerequisite absent and the direct license attempt could continue to fail for the new user.

The optional country/region profile data and the usageLocation attribute are not interchangeable in the Microsoft 365 licensing check. The assignment still fails because the employee's Usage location, not generic contact geography, is missing.

A newly created identity can have a different object ID and lose references to the original security principal. Deletion is not needed for a verified forgotten-password case.

Azure RBAC determines operations on Azure resources, not the Entra password that the employee uses to authenticate. Reassigning roles would not repair the credential.

Display-name changes are visible profile updates, not authentication credential resets. The user would remain unable to sign in with the forgotten password.

A UPN edit changes the authentication name rather than the display label; federation is not ready for that domain transition, so this introduces the very sign-in risk the scenario excludes.

These attributes affect messaging aliases but do not guarantee the address-book displayName changes; the stated requirement is the visible person name, not email routing.

Directory object IDs are immutable identifiers, not names to rebrand. Attempting to replace identities would also break the stable app references required by the case.

A password reset helps protect against reuse of a compromised password and can revoke some token classes, but its behavior depends on the client and token type. It is not a reliable stand-in for the requested explicit invalidation of all Entra refresh sessions or an immediate termination of every application-owned cookie. Perform the separate revoke-sessions operation and account for remaining access-token lifetimes.

Requiring more authentication methods changes what the user will need at a future sign-in, but does not itself invalidate an already stolen refresh token or change the refresh-session validity timestamp. A device using an extant refresh credential might continue silent renewal until other controls stop it. Registration hardening can complement incident response; it is not the specific revocation action the scenario asks for.

Disabling the registered device can contain the stolen laptop where device-based Conditional Access is enforced, but other clients may hold the same user’s refresh sessions. The security team specifically asks for account-wide invalidation so another client cannot silently obtain more tokens. Revoking the user sessions targets that broader token boundary; device disabling is additional targeted remediation.

A cloud-only change can be overwritten or contradicted by the authoritative synchronized state. It does not implement the permanent account lifecycle action in the source directory.

Group removal may block particular applications but cannot guarantee the disabled state of an on-premises mastered identity. Source-directory authentication remains possible and synchronization still treats the user as enabled.

A cloud password reset does not ensure the authoritative synchronized account remains disabled. Even if one credential stops working, the enabled source identity can remain active or be synchronized again.

The mail/contact address is not the cloud user's sign-in userPrincipalName. Changing it may change displayed email information, but Entra sign-in for alex@fabrikam.example requires updating the UPN to the verified custom suffix while preserving the same user object.

Display name is descriptive directory metadata; changing it does not replace the user principal name used at sign-in.

Domain verification enables use of the suffix, but the existing cloud user still signs in with the old UPN until its property changes.

Bulk B2B guest invitation is meant to invite outside collaborators who authenticate using external identities. The school needs new internal cloud-only staff users with individual Entra sign-in names and administrator-supplied initial passwords, not external guest relationships. Using invitations would create a different identity lifecycle and could fail to establish the intended workforce member accounts.

Bulk group-member addition changes memberships for users that already exist, rather than creating new Entra security principals. These 80 people have only HR CSV entries and have not yet been provisioned as cloud directory objects. A group-import attempt cannot establish their accounts, object IDs, or sign-in credentials; create the users first and optionally manage group memberships afterward.

A bulk update of existing users assumes matching Entra objects to modify, so it cannot provision an employee whose user object and object ID have not been created. The CSV carries new account identities rather than corrections to established users. The bulk-create workflow is the supported operation for this initial provisioning requirement; validate its results before assigning licenses or roles.

Azure RBAC determines access to Azure resources, not which directory is authoritative for synchronized phone attributes. Granting a privileged role would add risk without repairing attribute flow.

Licensing controls entitlement to services, not the source of the synchronized user profile value. Reassignment would not correct the phone attribute and could interrupt licensed workloads.

Cloud-only edits to source-managed identity attributes may be unavailable or overwritten by the next sync. The durable change belongs in the authoritative directory, not merely the cloud projection.