Microsoft Identity & Access Administrator

What is a Microsoft Entra tenant?

Which group membership type adds and removes users automatically based on attribute rules?

An 'Assigned' group differs from a dynamic group because it:

To let an external partner collaborate using their own organization's credentials, you use:

Which solution is designed for customer-facing sign-up/sign-in (consumer identity)?

Self-Service Password Reset (SSPR) allows users to:

Which license tier is required for dynamic groups and Conditional Access?

The hybrid identity method that syncs a hash of the on-prem password hash to the cloud is:

Which hybrid method validates passwords against on-prem AD in real time via an agent?

Which tool synchronizes on-premises AD objects into Entra ID?

The lightweight, agent-based alternative to Entra Connect Sync is:

To delegate administration over only a subset of users (e.g., one region), you use:

Following least privilege, which role manages users and groups but not global settings?

The most efficient way to assign licenses to many users is:

A soft-deleted Entra user can be restored for how long before permanent deletion?

A recommended design for emergency 'break-glass' accounts is that they are:

Registering a personal BYOD device for SSO/Conditional Access without full org join is:

A corporate Windows device fully managed and joined directly to the cloud is:

Which device state combines on-prem AD domain join with Entra registration?

Which attribute uniquely identifies a user object even if their UPN changes?

To create many users at once from a spreadsheet in the portal, you use:

Cross-tenant access settings primarily control:

Entra Password Protection helps by:

A user's sign-in name in Entra (UPN) typically looks like:

To force users to re-register their security (MFA/SSPR) info, an admin can:

Conditional Access works by evaluating signals and then applying:

Which Conditional Access mode lets you observe policy impact without enforcing it?

Sign-in frequency and persistent browser session are examples of:

A policy that reacts to a risky sign-in relies on which capability?

A user-risk policy responds to:

Which is a phishing-resistant, passwordless hardware method?

Windows passwordless sign-in using biometrics or a PIN bound to the device is:

Microsoft Authenticator's passwordless sign-in option is called:

Which feature reduces MFA-fatigue attacks by showing a number to type in the app?

A time-limited passcode used to onboard a user or recover passwordless access is a:

Conditional Access 'authentication strengths' let you:

Named locations in Conditional Access are used to:

To stop legacy authentication protocols that can't do MFA, you should:

Smart lockout protects against:

Combined security information registration means users:

The recommended way to require MFA for administrators is:

Security defaults are best suited for:

Continuous Access Evaluation (CAE) provides:

Which license is required for risk-based Conditional Access and Identity Protection?

Entra ID Protection classifies risk into:

A grant control that requires a healthy device is:

Between legacy per-user MFA and Conditional Access MFA, the recommended approach is:

OATH tokens provide:

Which of these is NOT a valid Conditional Access condition?

Requiring users to accept a policy document before access uses:

FIDO2 passwordless authentication is built on which standards?

To investigate why Conditional Access allowed or blocked a sign-in, you check:

A good layered defense against password spray includes:

The Authentication methods policy lets admins:

Excluding break-glass accounts from an MFA-enforcing CA policy is important because:

Registering an application in Entra creates:

A service principal is:

The main benefit of a managed identity is:

A system-assigned managed identity's lifecycle is:

A user-assigned managed identity is:

Delegated permissions let an app act:

Application permissions let an app act:

Admin consent is required when an app requests:

For production apps, the more secure credential type is:

OpenID Connect (OIDC) primarily provides:

OAuth 2.0 primarily provides:

An 'enterprise application' in Entra represents:

To give a group access to an enterprise application, you:

App roles are used to:

Conditional Access for workload identities can restrict:

Consent phishing is best mitigated by:

Where do you review and revoke permissions an app was granted?

Automated user provisioning to SaaS apps in Entra uses:

Workload identity federation lets external workloads:

A 'verified publisher' badge on an app indicates:

Entitlement management packages related access into:

A catalog in entitlement management is:

Connected organizations in entitlement management enable:

Access reviews are used to:

Access reviews can target:

Recurring access reviews primarily help with:

Privileged Identity Management (PIM) provides:

In PIM, an 'eligible' assignment differs from 'active' because eligible:

PIM role activation can be configured to require:

PIM alerts help detect:

Terms of Use in governance are typically enforced through:

Lifecycle workflows automate:

Separation of Duties in access packages prevents:

Which license is required for PIM, access reviews, and entitlement management?

Privileged access groups allow:

Reviewers in an access review can be:

'Auto-apply results' in an access review means:

Guest (external user) access is best governed with:

The approval workflow for an access request is configured in:

The overarching goal of identity governance is to ensure:

An access package assignment can be set to automatically:

Which pairing best supports audit and compliance evidence?

To grant least-privilege admin access only when needed, combine:

Entitlement management is especially useful for:

A key benefit of just-in-time access over standing privilege is: