MS-100 Microsoft 365 Identity and Services Questions and Answers

Graphical user interface, text, application Description automatically generated

Graphical user interface, text, application, chat or text message Description automatically generated

• User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Security Reader role can view reports.

The Compliance Management role can schedule the email delivery of security and compliance reports.

Sending actionable messages via email is supported. You use actionable message cards.

Scenario:

Create an email workflow solution for expense claims. Users will submit their expense claims and the system will email an approval request to their manager.

The expense claims solution must provide managers with claim information and the ability to manage the claim by using Microsoft Outlook, Outlook on the web, or Outlook for iOS and Android.

All new users must be assigned Office 365 licenses automatically.

To enable Microsoft 365 license assignment, the users must have a username. This is also the UPN. The users must also have a Usage Location.

• Vendors must be able to authenticate by using their Microsoft account when accessing Contoso resources.

You can invite guest users to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest user must then redeem their invitation to access resources. An invitation of a user does not expire.

The invitation will include a link to create a Microsoft account. The user can then authenticate using their Microsoft account. In this question, the vendors already have Microsoft accounts so they can authenticate using them.

Graphical user interface, text, application Description automatically generated

References:

• The members of Group1 must be required to answer a security question before changing their password.

If SSPR (Self Service Password Reset) is enabled, you must select at least one of the following options for the authentication methods. Sometimes you hear these options referred to as "gates."

Mobile app notification

Mobile app code

Email

Mobile phone

Office phone

Security questions

You can specify the required authentication methods in the Password reset properties of the Azure AD tenant. In this case, you should set the required authentication method to be ‘Security questions’.

• User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Security Reader role can view reports but not schedule the email delivery of security and compliance reports.

The Exchange Online Compliance Management role can schedule the email delivery of security and compliance reports.

Fabrikam plans to implement a Microsoft 365 Enterprise subscription and move all email and shared documents to the subscription.

All users must be able to exchange email messages successfully during Project1 by using their current email address.

After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.

This configuration requires a hybrid Exchange configuration during the pilot phase. This means that you will have mailboxes hosted in Exchange Online and mailboxes hosted in Exchange on-premise.

The first steps to configure Exchange hybrid are to Create the Azure AD tenant, add the Fabrikam.com domain as a custom domain, then configure directory synchronization to replicate the on-prem Active Directory user accounts to Azure Active Directory.

In the exhibit, seamless single sign-on (SSO) is disabled. Therefore, as SSO is disabled in the cloud, the Sales department users can access only on-premises applications by using SSO.

In the exhibit, directory synchronization is enabled and active. This means that the on-premises Active Directory user accounts are synchronized to Azure Active Directory user accounts. If the on-premises Active Directory becomes unavailable, the users can access resources in the cloud by authenticating to Azure Active Directory. They will not be able to access resources on-premises if the on-premises Active Directory becomes unavailable as they will not be able to authenticate to the on-premises Active Directory.

• User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Security Reader role can view reports but not schedule the email delivery of security and compliance reports.

The Help Desk role cannot schedule the email delivery of security and compliance reports.

Graphical user interface, text, application Description automatically generated

Box 1: Office Add-ins

Scenario: SalesApp must be integrated with Microsoft Word and must combine images and text from multiple sources to create a quotation as a DOCX file.

You can use the Office Add-ins platform to build solutions that extend Office applications and interact with content in Office documents.

Box 2: Microsoft Visual Studio

Visual Studio can be used to create Office Add-ins for Excel, Outlook, Word, and PowerPoint. An Office Add-in project gets created as part of a Visual Studio solution and uses HTML, CSS, and JavaScript.

Box 3: Fluent UI

Fluent UI is the upcoming and continually evolving design system for Microsoft 365. Currently, there is an ongoing merge in the process to have one consistent UI Framework across the Microsoft ecosystem.

Graphical user interface, application Description automatically generated

Box 1:

A Password Administrator or a User Administrator can reset the password non-administrative users.

Box 2: A User Administrator can configure other attributes such as the Manager attribute of non-administrative users.

Contoso plans to provide email addresses for all the users in the following domains:

• East.adatum.com
• Contoso.adatum.com
• Humongousinsurance.com

To verify three domain names, you need to add three TXT records.

You need to configure the device settings in Azure Active Directory.

1. Go to the Azure Active Directory admin center.

2. Select Azure Active Directory.

3. Select Devices.

4. Select Device Settings.

5. Toggle the ‘Require Multi-Factor Auth to join devices’ setting to Yes.

6. Click Save to save the changes.

References:

https://docs.m icrosoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

• User4 must be able to reset User3 password.

User3 is assigned the Customer Lockbox Access Approver role. Only global admins can reset the passwords of people assigned to this role as it’s considered a privileged role.

Allow users to shop controls the shopping experience in Microsoft Store for Education. When this setting is on, Purchasers and Basic Purchasers can purchase products and services from Microsoft Store for Education.

References:

https://docs.microsoft.com/en-us/microsoft-st ore/acquire-apps-microsoft-store-for-business

References:

https://docs.microsoft.com/en-us/azure/active -directory/manage-apps/application-proxy-configure-hard-coded-link-translation

Box 1:

Yes. User1 is in Group1 which is assigned to Role1. Device1 is in the device group named ATP1 which Group1 has access to. Role1 gives Group1 (and User1) View Data Permission. This is enough to view Device1 in Windows Security Center.

Box 2:

Yes. User2 is in Group2 which is assigned to Role2. Role2 gives Group2 (and User2) View Data Permission. This is enough to sign in to Windows Security Center.

Box 3:

Yes. User3 is in Group3 which is assigned the Windows ATP Administrator role. Someone with a Microsoft Defender ATP Global administrator role has unrestricted access to all machines, regardless of their machine group association and the Azure AD user groups assignments.

Box 1:

Office 365 ProPlus feature updates will be installed twice a year in March and September.

The Channel element in the configuration file is set to ‘Targeted’. This means Semi-Annual Targeted.

To help your organization prepare for a Semi-Annual Channel release, Microsoft provides Semi-Annual Channel (Targeted). The primary purpose of this update channel is to give pilot users and application compatibility testers in your organization a chance to work with the upcoming Semi-Annual Channel release

Box 2:

Microsoft Office 365 ProPlus applications must be installed from a network share only.

The AllowCDNFallback value is currently set to true. The purpose of this setting is to enable Office 365 to be downloaded from Microsoft’s Content Delivery Network if the network share is unavailable. The AllowCDNFallback value should be set to false to meet the technical requirement.

The Password protection settings allows you to specify a banned password list of phrases that users cannot use as part of their passwords.

References:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premisesoperations

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-configure

https://docs .microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad#custombanned-password-list

User1, User2 and User3 have each been assigned a SharePoint license directly. Therefore, they are all licensed for SharePoint Online.

Changing the group memberships will only affect whether or not they are licensed for Exchange Online because the Exchange Online licenses are assigned to Group1.

• A user named User1 must be able to view all DLP reports from the Microsoft 365 admin center.

Users with the Security Reader role have global read-only access on security-related features, including all information in Microsoft 365 security center, Azure Active Directory, Identity Protection, Privileged Identity Management, as well as the ability to read Azure Active Directory sign-in reports and audit logs, and in Office 365 Security & Compliance Center.

Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.

Fabrikam does NOT plan to implement identity federation.

All users must be able to exchange email messages successfully during Project1 by using their current email address.

During Project1, some users will have mailboxes in Microsoft 365 and some users will have mailboxes in Exchange on-premises. To enable users to be able to exchange email messages successfully during Project1 by using their current email address, we’ll need to configure hybrid Exchange.

A new way to migrate mailboxes in a hybrid Exchange configuration is to use the Microsoft 365 data migration service. The data migration service can migrate Exchange, SharePoint and OneDrive. Therefore, we need to start a data migration and click Exchange as the service to be migrated.

• User3 must be able to manage Office 365 connectors.
• The principle of least privilege must be used whenever possible.

Office 365 connectors are configured in the Exchange Admin Center.

You need to assign User3 the Organization Management role to enable User3 to manage Office 365 connectors.

A Global Admin could manage Office 365 connectors but the Organization Management role has less privilege.

During Project1, some users will have mailboxes in Microsoft 365 and some users will have mailboxes in Exchange on-premises. To enable users be able to exchange email messages successfully during Project1 by using their current email address, we’ll need to configure hybrid Exchange.

To migrate mailboxes in a hybrid Exchange configuration, you use Exchange admin center perform Remote move migrations.

Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.

Fabrikam does NOT plan to implement identity federation.

All users must be able to exchange email messages successfully during Project1 by using their current email address.

During Project1, some users will have mailboxes in Microsoft 365 and some users will have mailboxes in Exchange on-premises. To enable users to be able to exchange email messages successfully during Project1 by using their current email address, we’ll need to configure hybrid Exchange.

A new way to migrate mailboxes in a hybrid Exchange configuration is to use the Microsoft 365 data migration service. The data migration service can migrate Exchange, SharePoint and OneDrive. Therefore, we need to start a data migration and click Exchange as the service to be migrated.

You need to assign the ‘Password Administrator’ role to Alex Wilber. A user assigned the Password Administrator role can reset passwords for non-administrators and Password administrators.

1. Go to the Azure Active Directory admin center.

2. Select Users.

3. Select the Alex Wilber account to open the account properties page.

4. Select ‘Assigned roles’.

5. Click the ‘Add Assignments’ button.

6. Select Password Administrator then click the Add button.

References:

https://docs.microsoft.com/en-us/ office365/admin/add-users/about-admin-roles?view=o365-worldwide

• Project1: During Project1, the mailboxes of 100 users in the sales department will be moved to Microsoft 365.

• Project2: After the successful completion of Project1, Microsoft Teams & Skype for Business will be enabled in Microsoft 365 for the sales department users.

• After the planned migration to Microsoft 365, all users must be signed in to on-premises and cloud-based applications automatically.

• Fabrikam does NOT plan to implement identity federation.
• After the planned migration to Microsoft 365, all users must continue to authenticate to their mailbox and to SharePoint sites by using their UPN.

You need to enable password hash synchronization to enable the users to continue to authenticate to their mailbox and to SharePoint sites by using their UPN.

You need to enable SSO to enable all users to be signed in to on-premises and cloud-based applications automatically.

• User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Security Administrator role can view reports but not schedule the email delivery of security and compliance reports.

The View-Only Organization Management role cannot schedule the email delivery of security and compliance reports.

Device 1:

No because Device1 is in group3 which has Policy1 assigned which requires BitLocker.

Device 2:

No because Device2 is in group3 which has Policy1 assigned which requires BitLocker. Device2 is also in Group2 which has Policy2 assigned but the BitLocker requirement is not configured in Policy2.

Device3:

Yes because Device3 is in Group2 which has Policy2 assigned but the BitLocker requirement is not configured in Policy2.

When you add a custom domain to Office 365, you need to verify that you own the domain. You can do this by adding either an MX record or a TXT record to the DNS for that domain.

• An on-premises web application named App1 must allow users to complete their expense reports online.

Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client. Application Proxy includes both the Application Proxy service which runs in the cloud, and the Application Proxy connector which runs on an on-premises server. Azure AD, the Application Proxy service, and the Application Proxy connector work together to securely pass the user sign-on token from Azure AD to the web application.

In this question, we need to add an enterprise application in Azure and configure a Microsoft AAD Application Proxy connector to connect to the on-premises web application (App1).

Fabrikam plans to create a group named UserLicenses that will manage the allocation of all Microsoft 365 bulk licenses.

The memberships of UserLicenses must be validated monthly. Unused user accounts must be removed from the group automatically.

The group needs to be a Security group.

Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access.

Depending on what your organization's Office 365 subscription includes, the Dashboard in Security & Compliance includes several widgets, such as Threat Management Summary, Threat Protection Status, Global Weekly Threat Detections, Malware, etc. The Compliance admin center in Microsoft 365 contains much of the same information but also includes additional entries focusing on alerts, data insights.

The Monitoring and reports section from the Compliance admin center does not display a list of the features that were recently updated in the tenant so this solution does not meet the goal.

To meet the goal, you need to use Message center in the Microsoft 365 admin center.