Microsoft Certified: Identity and Access Administrator Associate — Practice Set 1

Question 1

Your organization uses Microsoft Entra ID and needs to synchronize user accounts from an on-premises Active Directory environment to the cloud. The hybrid identity team wants to use a cloud-based synchronization agent rather than installing a full server-side component. Which synchronization solution should you implement?

Accepted Answer

Microsoft Entra Cloud Sync uses a lightweight provisioning agent installed on-premises and manages synchronization logic in the cloud. It is purpose-built for organizations that want a simpler, cloud-managed alternative to Microsoft Entra Connect Sync, which requires a heavier server-side installation. AD FS is a federation solution for claims-based authentication, not directory synchronization. Microsoft Entra Connect Health monitors sync health but does not perform synchronization.

Question 2

You are an identity administrator. Your organization needs to allow external partners from a specific organization to access internal SharePoint sites using their own corporate identities, without creating guest accounts in your Microsoft Entra tenant. Which Microsoft Entra feature should you configure?

Accepted Answer

B2B direct connect (configured via Cross-tenant access settings) allows users from a partner Microsoft Entra tenant to access your resources using their home tenant credentials without creating guest objects in your directory. This is ideal for shared channels in Microsoft Teams or SharePoint. B2B collaboration creates guest accounts in your directory. External ID with self-service sign-up is for consumer/external identity scenarios. Azure AD Domain Services forest trust is for on-premises scenarios.

Question 3

Your organization is planning to migrate from AD FS to Microsoft Entra ID for authentication. Some applications currently rely on AD FS claims rules to populate custom attributes. Which Microsoft Entra feature provides equivalent claims customization for these applications after migration?

Accepted Answer

Claims mapping policies in Microsoft Entra ID allow you to customize the claims that are emitted in tokens for specific applications, similar to AD FS claims transformation rules. You can add, modify, or remove claims for enterprise applications using these policies. Custom security attributes are internal metadata about users and are not directly emitted as claims without a claims policy. Connect attribute filtering controls which objects are synced. Administrative units are for managing scope of administration.

Question 4

Your organization uses Microsoft Entra ID and needs to manage a large number of external guest users. You need to ensure that guest user access is reviewed periodically and automatically removed if the reviewer does not respond. Which two features should you configure? Choose 2.

Accepted Answer

Access reviews with auto-apply results can be configured to automatically remove user access or disable accounts when a reviewer does not respond within the review period, enforcing the principle of least privilege for guest users. Entitlement management lifecycle policies for external users allow you to define what happens when a guest user's access package assignment expires, including removing the guest account. ID Protection focuses on risky sign-ins, not periodic access review. Conditional Access re-authentication does not remove access. Connect Sync filtering is for on-premises sync, not cloud-only guests.

Question 5

Your organization has Microsoft Entra Connect Sync running in password hash synchronization mode. Users report that they can sign in to on-premises resources but cannot sign in to Microsoft 365 with their synchronized accounts. Microsoft Entra Connect Health shows no sync errors. What is the most likely cause and remediation?

Accepted Answer

If on-premises UPN suffixes (e.g., user@contoso.local) do not match a verified domain in Microsoft Entra ID, synchronized accounts are created with an onmicrosoft.com UPN fallback and users cannot sign in with their expected credentials to Microsoft 365. The fix is to add the UPN suffix as a custom domain in Microsoft Entra ID and verify it via DNS, then update the on-premises UPN suffix to match. Connect Health not showing errors means sync itself is working correctly. Password hash sync issues would show sync errors. License assignment affects service access but not sign-in. Service account permission issues would appear as sync errors in Connect Health.

Question 6

Your organization has a global Microsoft Entra ID tenant with users across multiple countries. You need to delegate identity administration so that helpdesk staff in each country can only manage users in their respective country without being able to affect users in other countries. Which Microsoft Entra feature should you use?

Accepted Answer

Administrative units in Microsoft Entra ID allow you to restrict the scope of administrative role assignments to a subset of users, groups, or devices. By creating an administrative unit per country and assigning the User Administrator (or Helpdesk Administrator) role scoped to that administrative unit, helpdesk staff can only manage users within their country's administrative unit. Dynamic groups and tenant-level role assignments do not restrict administrative scope — a User Administrator can manage all users in the tenant. Creating separate tenants is operationally complex and is not the recommended approach for delegation.

Question 7

Your organization wants to allow users to reset their own passwords without calling the helpdesk. Users must verify their identity using two methods before resetting their password. Which Microsoft Entra feature should you configure?

Accepted Answer

Self-service password reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords after verifying their identity. You can configure the number of authentication methods required (one or two) and specify which methods are available (authenticator app, email, phone, security questions). ID Protection risk policies trigger remediation but are not the SSPR configuration. PIM is for privileged role management. Conditional Access controls sign-in conditions, not the SSPR experience itself.

Question 8

Your organization is implementing a passwordless authentication strategy. The security team requires that authentication be phishing-resistant and bound to a specific device. Which authentication method should you recommend?

Accepted Answer

Passkeys using FIDO2 security keys provide phishing-resistant, device-bound authentication. FIDO2 credentials are cryptographically tied to the specific device and the relying party (the service), making them immune to phishing because the private key never leaves the device and credentials cannot be replicated to a phishing site. OATH hardware tokens use one-time passwords that can be intercepted. Microsoft Authenticator push notifications can be susceptible to push fatigue/MFA fatigue attacks. Temporary Access Pass is for bootstrapping authentication, not ongoing use.

Question 9

Your organization uses Microsoft Entra Conditional Access. A new policy is configured to require compliant devices for access to Microsoft 365 apps. Several remote workers report that they can no longer access their email. Investigation shows their devices are enrolled in Microsoft Intune but are marked non-compliant due to a missing compliance policy assignment. What is the fastest remediation?

Accepted Answer

If devices are enrolled but non-compliant due to a missing compliance policy, assigning the correct compliance policy to the users/groups and triggering a compliance check (via Intune Company Portal or Sync) will resolve the compliance status without removing and re-enrolling devices. Deleting and re-enrolling devices is disruptive and unnecessary. Excluding users from the Conditional Access policy is a security risk and does not fix the root cause. Setting the policy to Report-only mode disables enforcement and is inappropriate for production.

Question 10

Your organization needs to implement Conditional Access policies. During testing, you want to evaluate the impact of a new policy on users without actually blocking their access. Which Conditional Access mode should you use?

Accepted Answer

Report-only mode in Conditional Access evaluates policies and logs what the outcome would have been without actually enforcing them. This allows administrators to assess the impact on sign-ins by reviewing the sign-in logs, which show whether each sign-in would have been allowed, blocked, or required additional controls. There is no grace period concept in Conditional Access. Assigning to a test group limits scope but still enforces the policy. Grant access with no controls is a permanent permissive configuration, not an evaluation mode.

Question 11

Your organization's Microsoft Entra ID Protection is generating sign-in risk detections for several users. The security team wants these users to be automatically prompted to complete MFA and, if they pass MFA, have their sign-in risk dismissed automatically. Which Microsoft Entra feature achieves this?

Accepted Answer

A Conditional Access policy with a sign-in risk condition (set to medium or high) that grants access contingent on satisfying MFA will prompt risky users to complete MFA. When MFA is successfully satisfied, Microsoft Entra ID automatically remediates (dismisses) the sign-in risk. While ID Protection has its own sign-in risk policy, Microsoft recommends configuring sign-in risk remediation via Conditional Access for greater flexibility and consistent policy management. PIM manages privileged role activation. Sentinel playbooks introduce latency and complexity for real-time sign-in remediation.

Question 12

Your organization is deploying Global Secure Access for remote employees. You need to ensure that internet-bound traffic from employee devices is inspected and filtered, and that access to Microsoft 365 is optimized without routing through the on-premises proxy. Which two Global Secure Access components should you deploy? Choose 2.

Accepted Answer

Global Secure Access Internet Access profile routes and inspects employee internet traffic through Microsoft's security service edge, enforcing web content filtering and threat protection. The Internet Access for Microsoft 365 component provides a dedicated, optimized path for Microsoft 365 traffic, bypassing the corporate proxy for improved performance while maintaining security controls. Private Access replaces VPN for internal application access but is not described in the scenario. Application Proxy is a legacy per-application connector approach, not part of Global Secure Access. Defender for Cloud Apps is a CASB solution, not a Global Secure Access component.

Question 13

Your organization wants to prevent a Conditional Access policy from locking out all users, including the Emergency Access accounts. The compliance team requires that the Emergency Access accounts must always be able to sign in. What is the best practice for configuring Conditional Access to accommodate this requirement?

Accepted Answer

Microsoft's best practice is to exclude Emergency Access (break-glass) accounts as individual user exclusions in Conditional Access policies, not via groups. Group membership can be modified intentionally or accidentally, and dynamic group evaluation can cause delays. Direct user exclusions provide the most reliable guarantee that the accounts remain accessible. IP-based named location exclusions are fragile because emergency access may be needed from any location. ID Protection exclusion lists are not a Conditional Access concept.

Question 14

You are an identity administrator. A development team needs their application running in Azure App Service to write messages to an Azure Service Bus queue. The solution must not require any credentials to be stored in the application or its configuration. Which identity type should you use for the application?

Accepted Answer

A user-assigned managed identity (or system-assigned managed identity) allows the App Service to authenticate to Azure services like Service Bus without any credentials in the application code or configuration. The identity is managed by Azure and the App Service can obtain tokens automatically. A service principal with a client secret in Key Vault improves secret management but still requires credentials. Shared access policy keys are static credentials. Application registrations with certificates are an improvement but still involve credential management.

Question 15

Your organization uses Microsoft Defender for Cloud Apps to monitor SaaS application usage. You discover that employees are using an unsanctioned cloud storage application that stores data in a non-approved region. Which Defender for Cloud Apps action should you take to prevent further use of this application?

Accepted Answer

Marking an application as Unsanctioned in the Microsoft Defender for Cloud Apps Cloud App Catalog generates block scripts that can be pushed to integrated network appliances (firewalls, proxies, Secure Web Gateways) to prevent access to the application's domains. An access policy monitors but does not block. A session policy limits actions within an already-established session (requires Conditional Access App Control integration). An OAuth app policy addresses OAuth permission grants, not direct browser access to the app.

Question 16

Your organization has an enterprise application registered in Microsoft Entra ID that allows users to sign in. Administrators report that any user in the tenant can access the application, but the requirement is that only members of a specific security group should have access. What should you configure?

Accepted Answer

Enabling 'Assignment required' on an enterprise application in Microsoft Entra ID means that only users and groups explicitly assigned to the application can sign in. By then assigning only the specific security group, you enforce group-based access. Without 'Assignment required', any user in the tenant can access the application. A Conditional Access policy can enforce MFA or device compliance but 'Assignment required' is the direct mechanism for restricting which users can access an application. The groupMembershipClaims manifest property controls what group claims are included in tokens, not who can access the app. Permission scopes control API access, not application sign-in.

Question 17

Your organization needs to implement an on-premises web application so that external users can access it through Microsoft Entra ID without requiring a VPN. The application uses Windows Integrated Authentication (Kerberos). Which two components must you deploy? Choose 2.

Accepted Answer

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications without a VPN. The Application Proxy connector is installed on a domain-joined server in the on-premises network and proxies requests between Microsoft Entra ID and the application. For applications using Kerberos/Windows Integrated Authentication, Kerberos Constrained Delegation must be configured so the connector server can obtain Kerberos tickets on behalf of authenticated users. Cloud Sync is for directory synchronization, not application proxy. A VPN gateway defeats the purpose of Application Proxy. Defender for Cloud Apps is a CASB, not an on-premises app publishing solution.

Question 18

You are reviewing OAuth app permissions in your Microsoft Entra tenant. You discover an application that was granted User.ReadWrite.All application permissions (not delegated) by a user via a consent prompt. This permission should only be granted by an administrator. What caused this and how should you prevent it?

Accepted Answer

If the tenant's user consent settings are configured to allow users to consent to applications (even from verified publishers) for any permission, a user could consent to high-privilege application permissions like User.ReadWrite.All. The remediation is to configure the user consent setting to allow only low-impact delegated permissions or to require admin consent for all applications. This ensures high-privilege permissions like application-level User.ReadWrite.All always require explicit admin review. Application permissions typically require admin consent by design, but permissive tenant settings can sometimes allow users to grant them if not properly configured.

Question 19

Your organization needs to provide new employees with access to multiple resources including SharePoint sites, Microsoft Teams, and a SaaS application on their first day. The process must be self-service so that the new employee's manager can request access before the start date. Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra entitlement management access packages bundle multiple resources (SharePoint, Teams, SaaS apps, groups) together and can be requested through a self-service portal. Access package policies can allow managers or other designated requestors to request access on behalf of new employees, with configurable approval workflows. Access reviews are for recertifying existing access, not provisioning new access. PIM manages privileged role eligibility, not general resource access bundling. Dynamic groups require the employee's attributes to already exist and cannot be requested.

Question 20

Your organization is implementing Microsoft Entra Privileged Identity Management for Azure AD roles. The security team wants to ensure that Global Administrators can only activate their role for a maximum of 4 hours and must provide a business justification. Where do you configure these settings?

Accepted Answer

PIM role settings for each specific role allow you to configure the maximum activation duration, whether a justification is required, whether MFA is required, and whether approval is required. These settings are configured per role in the PIM blade under Manage > Roles > [Role Name] > Settings. Conditional Access policies control sign-in conditions, not PIM activation parameters. Entra ID user settings manage tenant-wide defaults, not per-role PIM settings. ID Protection manages risky user remediation.

Question 21

Your organization conducts quarterly access reviews for all users with the Security Administrator role. A reviewer marks a user's access as 'Deny'. The access review is configured with auto-apply results. What happens to the user's role assignment when the review period ends?

Accepted Answer

When an access review has auto-apply results enabled and a reviewer denies a user's access, Microsoft Entra ID automatically removes the role assignment when the review completes and applies results. This eliminates the manual step of an administrator acting on review decisions. The user is not simply notified — the action is taken automatically. Moving to eligible is not an access review outcome (access reviews result in keep or remove). Disabling the account is an optional access review action for group membership reviews when configured, not the default for role reviews.

Question 22

Your organization needs to monitor Microsoft Entra ID sign-in activity and send audit logs to a Security Information and Event Management (SIEM) system for long-term retention beyond the 30-day default. Which diagnostic settings destination is most appropriate for streaming logs to a third-party SIEM?

Accepted Answer

Azure Event Hubs is the recommended destination for streaming Microsoft Entra ID logs to third-party SIEM systems (such as Splunk, IBM QRadar, or ArcSight) in real time. The SIEM connects to the Event Hub and consumes the log stream. Log Analytics workspaces are used for querying and analysis within Azure Monitor/Microsoft Sentinel. Azure Storage is for long-term archival, not real-time streaming to a SIEM. Microsoft Sentinel is a Microsoft SIEM, not a third-party SIEM integration point.

Question 23

Your organization is implementing Microsoft Entra entitlement management. You need to create an access package for external partner users that automatically expires after 90 days and requires the external user's sponsor to approve renewal. Which two settings should you configure in the access package policy? Choose 2.

Accepted Answer

Setting the access package assignment expiration to 90 days ensures that external users' access automatically expires after 90 days. Enabling renewal with sponsor approval required means that when the external user's access is about to expire, the sponsor must approve the renewal for access to continue. This combination directly meets the requirement. The requestor policy is about who can request access, not expiry. An access review is for periodic recertification of existing access, not expiry-based renewal. Lifecycle workflows manage user account lifecycles, not access package assignment expiry.

Question 24

Your organization's Microsoft Entra ID is showing a declining Identity Secure Score. The top recommendation is to ensure that all privileged role holders have completed MFA registration. You need to find which specific privileged users have not registered for MFA. Which tool should you use?

Accepted Answer

The Authentication methods > User registration details report in the Microsoft Entra admin center shows which users have registered for each authentication method, including MFA. You can filter by privileged roles or export the data to identify specific users who have not completed MFA registration. ID Protection risky users report identifies risky sign-ins, not MFA registration status. PIM audit history shows role activation events. Access reviews are for certifying role assignments, not checking MFA registration.

Question 25

Your organization has implemented Microsoft Entra PIM for Azure AD roles. An auditor requires a report showing all role activations for the past 90 days, including who activated the role, when, and for how long. The auditor also needs to see any activations that were done outside of business hours. How should you generate this report?

Accepted Answer

For comprehensive audit reporting over 90 days with custom filtering (such as time-of-day analysis for after-hours activations), running a KQL query in Log Analytics against the AuditLogs table (which receives Microsoft Entra audit logs when diagnostic settings are configured) provides the most flexible and powerful analysis. PIM audit history in the admin center is limited to 30 days retention and has limited filtering. Azure Activity Log captures Azure Resource Manager operations, not Microsoft Entra directory operations. Sign-in logs show authentication events, not PIM role activation events.

SC-300 — Identity and Access Administrator Associate