Microsoft Practice Questions, Discussions & Exam Topics by our Authors

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. The tenant contains the named locations shown in the following table. You create the conditional access policies for a cloud app named App1 as shown in the following table. For each of the fol...

Author: Leah · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure subscription named Sub 1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table. Each user is assigned an Azure AD Premium P2 license. You plan to onboard and configure Azure AD Identity Protection. Which users can onboard Azure AD Identity Protection, r...

Author: Liam · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. From Azure AD Privileged Identity Management (PIM), you configure the settings for the Security Administrator role as shown in the following exhibit. From PIM, you assign the Security Administrator role to the following groups: * Group1: Active assignment type, permanently assigned * Group2: Eligible assignm...

Author: Ravi Patel · Last updated Jul 15, 2026

SNAPSHOT - Your company has an Azure subscription named Subscription1 that contains the users shown in the following table. The company is sold to a new owner. The company needs to transfer ownership of Subscription1. Which user can transfer the ownership and which tool should the user u...

Author: Sophia · Last updated Jul 15, 2026

SIMULATION - The developers at your company plan to create a web app named App12345678 and to publish the app to https://www.contoso.com. You need to perform the following tasks: * Ensure that App12345678 is registered to Azure Active Directory...

To achieve the goal of ensuring that App12345678 is registered to Azure Active Directory (Azure AD) and generating a password for it, we need to follow the steps that align with app registration and secret creation processes in Azure. Step-by-Step Explanation: 1. Ensure that App12345678 is registered to Azure Active Directory (Azure AD): To register an app in Azure AD, we need to perform an app registration in the Azure AD section of the portal. Registering the app allows it to interact with Azure AD for authentication and authorization purposes. 2. Generate a password for App12345678: Once the app is registered in Azure AD, we need to generate a client secret (password) for the app. This is typically done by creating a new client secret in the "Certificates & secrets" section of the registered application in Azure AD. --- Analyzing Possible Options for Completing the Task: 1. Option 1: Register the app in Azure Active Directory (Azure AD) through the Azure portal - Why this option works: To register the app to Azure AD, we would use the Azure AD App Registrations feature in the Azure portal. This is the primary method to register an app in Azure AD, allowing it to interact with Azure services and authenticate users or services. - Why other options are rejected: Other methods, like using the command line or scripts, mig...

Author: Michael · Last updated Jul 15, 2026

SIMULATION - You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com and a user named User1 in the new...

To complete the task of creating a new Azure Active Directory (Azure AD) directory named `12345678.onmicrosoft.com` and a user named `User1` in that directory, we need to go through specific steps in the Azure portal. Below, I’ll explain the key factors and reasoning behind each step. Steps to Complete the Task: 1. Create a New Azure AD Directory: To create a new Azure AD directory, you must first navigate to the Azure Active Directory section in the Azure portal and use the "Create a directory" option. This will allow you to create a new directory with a name like `12345678.onmicrosoft.com`, which is typically the default domain format for a new Azure AD directory. 2. Create a New User in the Directory: Once the directory is created, the next step is to create a new user (e.g., `User1`). This can be done by going to Users within the newly created directory and then selecting New User to add `User1` to the directory. --- Analyzing Possible Options: 1. Option 1: Azure Active Directory > Create a Directory > New User - Why this option works: This option aligns perfectly with the task. First, you need to create a new directory using Create a Directory under Azure Active Directory. After the directory is created, you can then create a new user under Users within that directory. - Why other options are rejected: This option combines both tasks of creating a ...

Author: GlowingTiger · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings: * Assignments: Include Group1, exclude Group2 * Conditions: Sign-in risk level: Medium and above * Access: Allow access, Require multi-factor authentication You need to identify what occurs when the u...

Author: Charlotte · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. In Azure AD Privileged Identity Management (PIM), the Role settings for the Contributor role are configured as shown in the exhibit. (Click the Exhibit tab.) You assign users the Contributor role on May 1, 2019 as shown in the following table. ...

Author: VioletCheetah55 · Last updated Jul 15, 2026

SNAPSHOT - You work at a company named Contoso, Ltd. that has the offices shown in the following table. Contoso has an Azure Active Directory (Azure AD) tenant named contoso.com. All contoso.com users have Azure Multi-Factor Authentication (MFA) enabled. The tenant contains the users shown in the following table. The multi-factor authentication settings for contoso.com are configured as shown in the fo...

Author: Sofia2021 · Last updated Jul 15, 2026

You have an Azure subscription. You configure the subscription to use a different Azure Active Directory (Azure AD) tenant. What are two possible effects of the change? Each correct answe...

When you change the Azure Active Directory (Azure AD) tenant for an Azure subscription, it can have significant effects on how resources are managed and accessed within the subscription. Let's analyze the potential effects listed and explain the reasoning behind selecting the correct options. Explanation of Options: A) Role assignments at the subscription level are lost. - Why this is correct: When you change the Azure AD tenant associated with a subscription, role assignments that are tied to the old tenant will be lost. Azure role-based access control (RBAC) is tied to Azure AD identities, and those identities may no longer exist in the new tenant. Therefore, all role assignments associated with users, groups, or service principals from the old tenant will be invalidated. - Why other options are rejected: This is a well-known effect of changing the Azure AD tenant, so it is a valid outcome. B) Virtual machine managed identities are lost. - Why this is correct: When the Azure AD tenant is changed, managed identities that were previously associated with resources like virtual machines (VMs) will no longer function. Managed identities are tied to the Azure AD tenant, and since you're changing the tenant, the managed identities would need to be recreated under the new tenant for them to work properly. - Why other options are rejected: This is also a known effect and is specifi...

Author: BlazingPhoenix22 · Last updated Jul 15, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in ...

Problem Scenario: - You have an Azure Storage account named sa1 in the RG1 resource group. - The storage account is accessed using shared access signatures (SASs) and stored access policies. - Unauthorized users have gained access to both the blob service and file service in sa1. - You need to revoke all access to sa1. Solution Review: Option A) Yes, generating new SASs will meet the goal. - Why this is incorrect: Generating new SASs does not revoke or invalidate existing SASs. If you generate new SASs, it only provides new access keys for future access; it does not revoke or invalidate existing SAS tokens that were issued earlier. The unauthorized users could still use the previously generated SAS tokens to access the services. SAS tokens are valid until their expiration, so generating new SAS tokens does not stop the unauthorized access from tokens that are already in use. Option B) No, generating new SASs will not meet the goal. - Why this is correct: ...

Author: Leo · Last updated Jul 15, 2026

You have an Azure subscription that contains virtual machines. You enable just in time (JIT) VM access to all the virtual machines. You need to connect to a...

When enabling just-in-time (JIT) VM access for virtual machines, the purpose is to minimize the exposure of the VM to the internet and only allow access when required. JIT is part of Azure Security Center and provides a way to restrict and manage access to virtual machines. Steps and Reasoning for the Correct Solution: What JIT VM Access Requires: - JIT access works by allowing you to request temporary access to a virtual machine via Remote Desktop Protocol (RDP) or SSH, based on predefined security rules. - Before you can connect to the VM, you need to request access through the Azure portal, which will temporarily open the necessary ports (e.g., RDP port 3389) for the duration of the access request. Option Analysis: A) From Azure Directory (Azure AD) Privileged Identity Management (PIM), activate the Security administrator user role. - Why this is rejected: The Security administrator role is useful for managing security policies and settings, but it does not specifically help with enabling access to a VM through JIT. JIT access is controlled at the Azure portal level, not through roles related to security management. This role wouldn't be necessary for accessing the VM itself. B) From Azure Active Directory (Azure AD) Privileged Identity Management (PIM), activate the Owner role for the virtual machine. - Why this is r...

Author: Isabella · Last updated Jul 15, 2026

SNAPSHOT - Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table. The tenant contains the groups shown in the following table. You configure a multi-factor authentication (MFA) registration policy that has the following settings: * Assignments: - Include: Group1 - Exclude: Group2 * Controls: Require Azure MFA r...

Author: Ravi Patel · Last updated Jul 15, 2026

SIMULATION - The developers at your company plan to publish an app named App12345678 to Azure. You need to ensure that the app is registered to Azure Active Directory (Azure AD). The registration must use the sign-on URLs of https:/...

To ensure that App12345678 is registered to Azure Active Directory (Azure AD) with the sign-on URL `https://app.contoso.com`, you will need to take the following steps in the Azure portal and select the appropriate option. Let’s break this down: Steps: 1. Sign in to the Azure portal: First, ensure that you are signed into the Azure portal with an account that has the necessary permissions to modify Azure AD applications (like an Azure AD admin or app registration permissions). 2. Navigate to Azure Active Directory: In the Azure portal, go to Azure Active Directory. 3. Go to App registrations: Under Azure Active Directory, select App registrations. 4. Select 'New registration': You would need to create a new app registration by clicking on New registration. 5. Configure the Registration: - Name: Enter `App12345678` as the name for the application. - Supported account types: Choose the appropriate account type, such as "Accounts in this organizational directory only" if it's meant to be used within the organization or "Accounts in any organizational directory" if it is to be used for a multi-tenant application. - Redirect URI (optional): Add `https://app.contoso.com` as the sign-on URL (this URL will serve as the entry point for users to sign in). 6. Complete the Registration: After configuring, click Register. Options Explanation: - Accounts in this organizational directory only: This option allows only users from the current Azure AD tenant to sig...

Author: Suresh · Last updated Jul 15, 2026

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. The User administrator role is assigned to a user named Admin1. An external partner has a Microsoft account that uses the user1@outlook.com sign in. Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: `Unable to invite user user1...

In this scenario, the goal is to allow Admin1 to invite an external partner with a Microsoft account (user1@outlook.com) to sign in to the Azure AD tenant (contoso.onmicrosoft.com). The error message "Unable to invite user user1@outlook.com. Generic authorization exception" suggests that there is a restriction on inviting external users, and Admin1 does not have the necessary permissions or configurations in place to complete the invitation process. Let's review the options and explain the reasoning behind the correct solution: Option Analysis: A) From the Roles and administrators blade, assign the Security administrator role to Admin1. - The Security administrator role gives Admin1 permissions to manage security-related settings and configurations in Azure AD but does not directly affect external user invitations. - The issue here isn't related to security configurations, but rather to external user collaboration settings. Therefore, this option does not resolve the issue. - Rejected: Not relevant to the task at hand. B) From the Organizational relationships blade, add an identity provider. - Identity providers are typically used when integrating external authentication systems (e.g., third-party identity providers like Google, Facebook, etc.). - In this case, the partner is using a Microsoft account, which is already a built-in identity provider (Microsoft account itself), so there is no need to add a new identity provider. - Rejected: Not necessary for inviting a Microsoft account user to Azure AD. C) From the Custom domain names blade, add a custom domain. - The custom domain names blade...

Author: Sofia · Last updated Jul 15, 2026

You have an Azure Active Directory (Azure AD) tenant. You have the deleted objects shown in the following table. On May 4, 2020, you attempt to restore the deleted objects by using the Azure Active Directory admin center. Which two objects can you...

In this scenario, we need to understand the restoration process in Azure Active Directory (Azure AD), specifically for deleted objects such as groups and users. Deleted objects can be restored within a specific retention period provided by Azure AD. The period during which deleted objects can be restored depends on the type of object (e.g., user, group) and the deletion time. Key Concepts: - Soft Deleted Objects: When an object is deleted in Azure AD, it is soft deleted and remains in a recoverable state for a certain period before it is permanently purged. The default retention period for deleted users is 30 days, and for groups, it can vary depending on the type of group. - Group Deletion: Azure AD groups (both security and Microsoft 365 groups) can be recovered if they are soft deleted within 30 days of deletion. - User Deletion: Users can be restored within 30 days from the deletion date, after which the object is permanently deleted. Now, let’s evaluate the options based on the retention period and deletion date. Given that the attempt to restore the deleted objects is made on May 4, 2020, we need to check whether each object is within the recovery period (30 days) or not. Option Analysis: A) Group1 - If Group1 was deleted within the last 30 days, it can be restored. However, if the group was deleted more than 30 days ago, it will no longer be available for restoration. Since the date of deletion isn't provided, we assume ...

Author: Emma Brown · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create an Azure role by using the following JSON file. You assign Role1 to User1 for RG1. For each of the following statements, selec...

Author: Liam · Last updated Jul 15, 2026

You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1. You plan to publish several apps in the tenant. You need to ensure that User1 can grant admin consent for the published apps. Which two possible user roles can you assign to User...

To allow User1 to grant admin consent for published apps in Azure Active Directory (Azure AD), we need to assign the appropriate roles. The admin consent process involves granting permissions to applications so they can access resources in the organization on behalf of the signed-in users. Let's analyze each of the roles and explain whether they grant the necessary permissions for admin consent. Option Analysis: A) Security administrator - The Security administrator role primarily focuses on managing security-related settings in Azure AD, including monitoring security incidents, configuring security policies, and responding to threats. - However, this role does not directly provide permissions to grant admin consent for apps. - Rejected: Not the appropriate role for granting admin consent for apps. B) Cloud application administrator - The Cloud application administrator role allows the user to manage applications in Azure AD. This includes tasks like assigning and managing permissions for apps and also granting admin consent to applications. - Selected: This role is specifically designed to manage applications and grant admin consent for them. C) Application administrator - The Application administrator role allows the user to manage ap...

Author: Sophia Clark · Last updated Jul 15, 2026

You have an Azure subscription that is associated with an Azure Active Directory (Azure AD) tenant. When a developer attempts to register an app named App1 in the tenant, the developer receives the error message shown in the following exhibit. ...

To address the issue where a developer is unable to register an app (App1) in an Azure AD tenant, we need to ensure that the Azure AD configuration allows users to register apps. Option Analysis: 1. A) Modify the Directory properties: - This option is used to change basic configurations about the directory itself, such as setting the default domain name or other organizational properties. It does not specifically control who can register applications in Azure AD. Therefore, it is not the right choice. 2. B) Set Enable Security defaults to Yes: - Enabling "Security defaults" is a feature in Azure AD that helps protect against identity-related security threats by enforcing basic security policies like multi-factor authentication (MFA). However, this does not directly control who can register applications. It focuses on securing the tenant's authentication process. Hence, it is not the right choice for the developer's issue with app registration. 3. C) Configure the Consent and permissions settings for e...

Author: Scarlett · Last updated Jul 15, 2026

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant and a user named User1. The App registrations settings for the tenant are configured as shown in the following exhibit. You plan to deploy an app named App1. You need to ensure that User1 can...

To ensure that User1 can register an app (App1) in Azure AD while adhering to the principle of least privilege, let's analyze the given roles and the requirements: Option Analysis: 1. A) App Configuration Data Owner for the subscription: - The App Configuration Data Owner role is specific to managing App Configuration resources within Azure, which is a different service from Azure Active Directory (Azure AD). This role would not be suitable for managing Azure AD application registrations, as it does not deal with user permissions within Azure AD. This option is rejected. 2. B) Managed Application Contributor for the subscription: - The Managed Application Contributor role allows users to manage Azure managed applications but does not directly grant permissions to register or manage Azure AD apps. It is used more for managing apps deployed in Azure via Azure Resource Manager and does not grant permissions for registering apps in Azure AD itself. This option is rejected. 3. C) Cloud application administrator in Azure AD: - The Cloud Application Administrator role in Azure AD allows users to manage applications registered in the...

Author: Rohan · Last updated Jul 15, 2026

You have the Azure virtual machines shown in the following table. Each virtual machine has a single network interface. You add the network interface of VM1 to an application security group named ASG1. You need to identify...

To determine which virtual machine network interfaces (NICs) can be added to an Application Security Group (ASG), we need to consider the configuration of the virtual machines and their network interfaces. The key point here is that an Application Security Group (ASG) can only contain network interfaces (NICs) from the same virtual network. Therefore, the virtual machines that share the same virtual network as VM1 can have their network interfaces added to ASG1. Steps to evaluate: 1. VM1 and ASG1: You have already added the network interface of VM1 to ASG1. This means that VM1's NIC is part of ASG1, so any other virtual machine whose NIC resides in the same virtual network as VM1 can also be added to ASG1. 2. Virtual Network Configuration: To determine which other virtual machines' NICs can be added, we need to know which VMs share the same virtual network as VM1. Based on the question, this specific detail is inferred. If VM2, VM3, VM4, and VM5 all exist within the same virtual network as VM1, then their NICs can be added to ASG1. If any of these VMs are located in a different virtual network, their NICs cannot be added to ASG1. Option Analysis: 1. A) VM2 only: - This option would be correct only if VM2 is the only virtual machine in the same virtual network as VM1. However, we don’t have enough information to conclude that only VM2 shares the vir...

Author: Vikram · Last updated Jul 15, 2026

SIMULATION - You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com. The new directory must contain a user named user12345678 who...

To create a new Azure Active Directory (Azure AD) directory named `12345678.onmicrosoft.com` and a user named `user12345678` who is configured to sign in using Azure Multi-Factor Authentication (MFA), we need to consider the following steps: 1. Create a New Azure AD Directory: - To create a new directory, you would use Azure AD's "Create a new directory" process, which involves creating a new Azure AD tenant. This directory will have the domain `12345678.onmicrosoft.com` by default. 2. Create a New User: - After the directory is created, we will need to add a new user named `user12345678` to that directory. This is done by creating a new user within the Azure AD directory. 3. Enable Azure Multi-Factor Authentication (MFA): - Azure Multi-Factor Authentication can be configured for the user `user12345678` after the user is created. MFA can be set up either for individual users or as a policy (such as conditional access policies) in the Azure AD portal. - Azure MFA can be configured through the Security settings, where you can enforce MFA either through the Security Defaults or through Conditio...

Author: William · Last updated Jul 15, 2026

You have an Azure subscription named Subcription1 that contains an Azure Active Directory (Azure AD) tenant named contoso.com and a resource group named RG1. You create a custom role ...

To determine where you can use Role1, the custom role that was created in the Azure Active Directory (Azure AD) tenant `contoso.com`, we need to evaluate the scope of role-based access control (RBAC) in Azure. RBAC roles can be assigned at different scopes within Azure, such as: - Azure AD tenant level (e.g., `contoso.com`). - Subscription level (e.g., `Subscription1`). - Resource group level (e.g., `RG1`). - Individual resource level. Key Considerations: 1. Azure AD Tenant (contoso.com): - When you create a custom role in Azure AD, the role is scoped to Azure AD. This means you can assign the role to users, groups, or service principals in the context of Azure Active Directory. 2. Subscription Level (Subscription1): - RBAC roles can be assigned at the subscription level. However, a custom Azure AD role cannot be assigned directly at the subscription level. Azure AD roles are primarily designed for managing Azure AD objects (users, groups, service principals, etc.). - Subscription-level roles, such as Owner, Contributor, or Reader, can be assigned at the subscription level, but custom roles created within Azure AD are specific to ...

Author: Ryan · Last updated Jul 15, 2026

You have an Azure subscription. You enable Azure Active Directory (Azure AD) Privileged Identity Management (PIM). Your company's security policy for administrator accounts has the following conditions: * The accounts must use multi-factor authentication (MFA). * The accounts must use 20-character complex passwords. * The passwords must be changed every 180 days. * The accounts must be managed by using PIM. You receive...

To minimize the number of generated alerts related to administrators not changing their passwords in the last 90 days, we need to consider the nature of the alerts and their connection to the conditions outlined in your security policy. Key Factors: 1. The accounts must use multi-factor authentication (MFA). 2. The accounts must use 20-character complex passwords. 3. The passwords must be changed every 180 days. 4. The accounts must be managed using PIM. Analysis of Each Option: A) Roles are being assigned outside of Privileged Identity Management: - This alert is triggered when roles are assigned without using PIM, which is a violation of the security policy. While this alert is relevant to PIM, it is not related to password expiration or MFA policies. Therefore, adjusting this alert would not directly minimize password-change-related alerts. - Rejected because it doesn't address the specific issue of password change intervals. B) Roles don't require multi-factor authentication for activation: - This alert indicates that MFA is not required for role activation, which is a violation of your policy that mandates MFA for admin accounts. However, this alert is about MFA enforcement, not password expiration. - Rejected because it doesn't address password change notifications or intervals. C) Administrators aren't using their privileged roles: - This alert notifies when admin...

Author: Noah Williams · Last updated Jul 15, 2026

Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD). Azure AD Connect is installed on a domain member server named Server1. You need to ensure that a domain administrator for the adatum.com domain can modify the synchronization o...

To ensure that a domain administrator for the adatum.com domain can modify the synchronization options in Azure AD Connect, we need to assign an appropriate Azure AD role based on the principle of least privilege. The goal is to grant sufficient permissions to manage synchronization without over-privileging the user. Key Factors: - Azure AD Connect is the service syncing on-premises AD to Azure AD. - The principle of least privilege should be followed, meaning only the necessary permissions should be granted for the task. - The domain administrator in adatum.com needs to modify synchronization options, which typically involves managing Azure AD Connect settings. Analysis of Each Option: A) Security administrator: - The Security administrator role allows managing security-related features within Azure AD, such as configuring security settings, managing conditional access policies, managing security logs, etc. - This role does not specifically grant permissions to manage Azure AD Connect synchronization options. - Rejected because it focuses on security and not on managing synchronization. B) Global administrator: - The Global administrator role grants full administrative rights across Azure AD, a...

Author: VenomousSerpent42 · Last updated Jul 15, 2026

You have an Azure subscription that contains the users shown in the following table. Which users can enabl...

To determine which users can enable Azure AD Privileged Identity Management (PIM), we need to understand the permissions required to enable PIM and the roles assigned to the users. Key Factors to Consider: - Azure AD Privileged Identity Management (PIM) is a service used to manage, control, and monitor access within Azure AD, specifically for privileged roles. - To enable PIM, a user must have sufficient privileges, typically granted by being assigned the Global Administrator or Privileged Role Administrator roles in Azure AD. These roles allow users to configure and manage PIM. - Global Administrator: This role has full access to all settings in Azure AD and is typically able to enable and configure PIM. - Privileged Role Administrator: This role specifically allows managing privileged roles and their settings, including configuring PIM. Scenario Analysis Based on Users and Roles: If the table shows the roles assigned to the users, we can evaluate based on the role that allows enabling PIM. Analyzing the Options: A) User2 and User3 only: - This option assumes that User2 and User3 have the necessary roles, such as Global Administrator or Privileged Role Administrator. If neither...

Author: Kai · Last updated Jul 15, 2026

You have an Azure subscription. You plan to create a custom role-based access control (RBAC) role that will provide permission to read the Azure Storage accou...

To create a custom role-based access control (RBAC) role that allows users to read an Azure Storage account, you need to configure the appropriate property in the RBAC role definition to grant the necessary permissions for reading storage data. Key Factors: - RBAC roles define the set of permissions granted to users, groups, or service principals. - For reading the Azure Storage account, the permissions required are related to reading data within the storage account, such as accessing blobs or files. - In Azure, there are two main types of permissions: - Actions: General permissions on resources (e.g., read, write, delete, etc.). - DataActions: Specific permissions related to data access, which is required for reading storage account data (e.g., blobs, files). - AssignableScopes: Defines where the role can be assigned, such as at the subscription, resource group, or resource level. - NotActions: Specifies the actions that should be excluded from the role, but this is not relevant in this case since we are concerned with granting read access. Analysis of Each Option: A) NotActions []: - NotActions defines the operations that are not allowed by the custom role. This is used to explicitly deny specific actions. However, this is not what we need to configure for reading a storage account. - Rejected because it defines what is excluded, not what is granted. B) DataActions []: - DataActions specifies permissions that allow ac...

Author: Amira · Last updated Jul 15, 2026

SNAPSHOT - You have a Microsoft Entra tenant named contoso.com. You collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com. Fabrikam.com has multi-factor authentication (MFA) enabled for all users. Contoso.com has the Cross-tenant access settings configured as shown in the Cross-tenant access settings exhibit. (Click the Cross-tenant access settings tab.) Contoso.com has the External collaboration settings configured as shown in the External collaboration settings exhibit. (Click the External collaboration settings tab.) You create a Conditional Access policy that has the following settings: * Name: CAPolicy1 * Assignments o Guest or external users: B2B collaboration guest users o Target r...

Author: Grace · Last updated Jul 15, 2026

SNAPSHOT - You have the hierarchy of Azure resources shown in the following exhibit. RG1, RG2, and RG3 are resource groups. RG2 contains a virtual machine named VM2. You assign role-based access control (RBAC) roles to the users shown in the following table. For each of the following sta...

Author: Carlos Garcia · Last updated Jul 15, 2026

SNAPSHOT - You plan to implement an Azure function named Function1 that will create new storage accounts for containerized application instances. You need to grant Function1 the minimum required privileges to create the storage accounts. The solution must minimize administrative effort. What should ...

Author: Matthew · Last updated Jul 15, 2026

You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant. From the Azure portal, you register an enterprise appl...

When you register an enterprise application in Azure, a resource is created in Azure Active Directory (Azure AD) to represent the application and its interaction with Azure AD. This allows the application to authenticate, get access tokens, and integrate with Azure AD for identity and access management. Key Factors: - Enterprise Application in Azure AD refers to an application that is integrated with Azure AD for identity and access management purposes. This can be a SaaS application or a custom-developed application. - When registering an enterprise application, Azure AD creates a corresponding service principal to represent the application in the directory. The service principal is essentially an identity for the application to interact with Azure resources. - Other options mentioned, like managed identity, X.509 certificates, and user accounts, are used for different purposes and are not automatically created when registering an enterprise application. Analysis of Each Option: A) A service principal: - Service Principal: When you register an enterprise application in Azure AD, a service principal is created automatically. This is an identity that the application uses to authenticate and gain access to Azure resources. The service principal allows Azure AD to manage access control for the application. - Selected because a service principal is automatically created during the registration of an enterprise application to enable authentication and authorization for the app. B) An X.509 certificate: - X.509 certificate: This is a type of certificate used for secure communication and identity verification (e.g., client certificates). It is not automatically created when registerin...

Author: Kunal · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant that contains the resources shown in the following table. User2 is the owner of Group2. The user and group settings for App1 are configured as shown in the following exhibit. You enable self-service application access for App1 as shown in the following exhibit. User3 is configured to approve access to App1. After you enable self-service application access for App1, who will be co...

Author: VenomousSerpent42 · Last updated Jul 15, 2026

You are securing access to the resources in an Azure subscription. A new company policy states that all the Azure virtual machines in the subscription must use managed disks. You need to prevent...

To enforce the policy that all Azure virtual machines in the subscription must use managed disks, you need a solution that allows you to prevent or audit specific configurations (such as the use of unmanaged disks) at the resource creation level. Key Factors: - The policy requires the ability to prevent users from creating virtual machines with unmanaged disks. - The solution must apply to the entire subscription and can be automated to ensure compliance. Analysis of Each Option: A) Azure Monitor: - Azure Monitor is primarily used for monitoring the health, performance, and usage of Azure resources. While you can use it to collect and analyze data, it doesn't provide a way to prevent specific configurations like the use of unmanaged disks. - Rejected because it is for monitoring and alerting, not for enforcing policies or preventing resource configurations. B) Azure Policy: - Azure Policy allows you to enforce specific rules and policies across Azure resources. It can be used to audit, restrict, or enforce specific configurations. You can create a custom policy that denies the creation of virtual machines with unmanaged disks. - In this scenario, you can define a policy that ensures only managed disks can be used when creating virtua...

Author: RadiantJaguar56 · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure subscription that contains the custom roles shown in the following table. In the Azure portal, you plan to create new custom roles by cloning existing roles. The new roles will be configured as shown in the following table. Which roles can you clone to create each ne...

Author: Harper · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure subscription that contains the Azure Active Directory (Azure AD) resources shown in the following table. You create the groups shown in the following table. Which resources can you add to Group5 and Group6? To answer, s...

Author: John · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains three security groups named Group1, Group2, and Group3 and the users shown in the following table. Group3 is a member of Group2. In contoso.com, you register an enterprise application named App1 that has the following settings: * Owners: User1 * Users and groups: Group2 You configure the properties of App1 as shown in...

Author: Liam · Last updated Jul 15, 2026

You have an Azure subscription that contains the resources shown in the following table. You need to ensure that ServerAdmins can perform the following tasks: * Create virtual machines in RG1 only. * Connect the virtual machines to the existing virtual networks in RG2 only. The solution must use the principle of least privilege. Which two role-based acces...

To ensure that ServerAdmins can create virtual machines in RG1 only and connect them to the existing virtual networks in RG2 only while adhering to the principle of least privilege, we need to assign the most appropriate role-based access control (RBAC) roles to the ServerAdmins. Let's break down the requirements and the roles available. Key Factors: 1. Create virtual machines in RG1 only: ServerAdmins must be able to create virtual machines but only in RG1. 2. Connect virtual machines to the existing virtual networks in RG2 only: ServerAdmins must also be able to connect the virtual machines to existing virtual networks in RG2. Analysis of Each Option: A) A custom RBAC role for RG2: - A custom RBAC role for RG2 could be used to grant specific permissions to interact with virtual networks in RG2. However, it's more common to use predefined roles for virtual network management. Custom roles would be an additional effort, especially when a predefined role like Network Contributor can handle the task. - Rejected because it's more efficient to use a predefined role for network-related tasks, like Network Contributor. B) The Network Contributor role for RG2: - The Network Contributor role allows users to manage network resources such as virtual networks, subnets, and network interfaces. Assigning this role to ServerAdmins in RG2 ensures they can connect the virtual machines to the existing virtual networks in RG2. - Selected because it grants the least privilege needed for connecting virtual machines to the virtual networks in RG2. C) The Contributor role for the subscription: - The Contributor role allows users to manage all resources (except for access control) at the subscription level, which would be excessive for this scenario. Giving the Contributor role at the subscription level grants broad permissions that are beyond the required scope of...

Author: Michael · Last updated Jul 15, 2026

SNAPSHOT - Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD). The Azure AD tenant contains the users shown in the following table. You configure the Authentication methods `" Password Protection settings for adatum.com as shown in the following exhibit. For each...

Author: Elijah · Last updated Jul 15, 2026

SNAPSHOT - Your company has an Azure subscription named Subscription1. Subscription1 is associated with the Azure Active Directory tenant that includes the users shown in the following table. The company is sold to a new owner. The company needs to transfer ownership of Subscription1. Which user can transfer the ownership and which t...

Author: Ethan Smith · Last updated Jul 15, 2026

You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM). A PIM user that is assigned the User Access Administrator role reports receiving an authorization error when performing a role assignment or viewing the list of assignments. You need to resolve the issue by ensuring that the PIM service principal has th...

In this scenario, the issue is that a PIM user with the User Access Administrator role is encountering an authorization error when performing a role assignment or viewing the list of assignments. To resolve this, you need to ensure that the PIM service principal has the correct permissions to perform these tasks, but you must adhere to the principle of least privilege. Key Factors: - The User Access Administrator role enables users to manage user access to resources in Azure but does not necessarily provide permissions to manage PIM itself or to view role assignments within PIM. - The PIM service principal is a critical entity that manages the PIM process, and it needs sufficient permissions to operate effectively. However, assigning overly broad permissions would violate the principle of least privilege. - The goal is to provide the necessary permissions to the PIM service principal for performing role assignments or viewing the list of assignments. Analysis of Each Option: A) Contributor: - The Contributor role provides broad permissions to manage resources, including creating, modifying, or deleting most resources within a subscription. However, this role includes excessive permissions for the task at hand (viewing and managing PIM assignments). - Rejected because it provides more permissions than necessary for managing PIM and performing role assignments. B) User Access Administrator: - The User Access Administrator role allows users to manage access to resources in Azure, including assigning roles and viewing assignments. This role is closely related to the task of man...

Author: Amelia · Last updated Jul 15, 2026

You have an Azure Active Directory (Azure AD) tenant that contains a user named Admin1. Admin1 is assigned the Application developer role. You purchase a cloud app named App1 and register App1 in Azure AD. Admin1 reports that the option to enable token encryption for App1 is un...

To allow Admin1, who is assigned the Application developer role, to enable token encryption for App1 in the Azure portal, you need to ensure that Admin1 has the appropriate level of access to manage the application's configuration, specifically token encryption. Key Factors: - Token encryption is a security feature that requires sufficient administrative privileges in Azure AD. - Application developer role allows Admin1 to develop and configure applications but may not include the specific permission to configure token encryption. - In Azure AD, Cloud application administrators and other higher privilege roles typically manage application configurations like token encryption, as these tasks are related to security and access control. Analysis of Each Option: A) Upload a certificate for App1: - Uploading a certificate could be part of setting up token encryption, but it does not directly address the permission issue that Admin1 faces. Even if a certificate is uploaded, Admin1 would still require the necessary permissions to configure token encryption. - Rejected because uploading a certificate does not solve the permission issue for enabling token encryption. B) Modify the API permissions of App1: - Modifying API permissions is important for managing how the application interacts with other resources, but it is not directly related to enabling token encryption. Token encryption is a specific configuration task in Azure A...

Author: Ahmed · Last updated Jul 15, 2026

You plan to deploy an app that will modify the properties of Azure Active Directory (Azure AD) users by using Microsoft Graph. You need to ensure th...

To ensure that the app can access Azure Active Directory (Azure AD) and modify the properties of Azure AD users using Microsoft Graph, the first step is to configure access to Azure AD for the app. Key Factors: - Microsoft Graph is an API that allows access to a wide range of resources within Azure AD, including user data and properties. - The app needs to be registered with Azure AD to allow it to interact with Microsoft Graph and access or modify Azure AD resources. - App registration in Azure AD is a key step that enables an app to authenticate and request necessary permissions to interact with Microsoft Graph. Analysis of Each Option: A) An app registration: - App registration in Azure AD is the process of registering an application in Azure AD so that it can authenticate and request permissions to access various Azure AD resources, including Microsoft Graph. By registering the app, you can define what type of access it requires (such as permissions to modify user properties in Azure AD). Once the app is registered, you can grant the necessary API permissions for it to interact with Microsoft Graph. - Selected because app registration is the first step in ensuring the app can authenticate with Azure AD and request the necessary permissions to access Microsoft Graph for modifying user properties. B) An external identity: - External identity refers to managing access for users from outside of your organization (e.g., users from partner organizations, or social accoun...

Author: StarryEagle42 · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create a custom RBAC role in Subscription1 by using the following JSON file. You assign Role1 to User1 on RG1. For each of the following statements,...

Author: Maya · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure subscription that contains the resources shown in the following table. The subscription is linked to an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. You create the groups shown in the following table. The membership rules for Group1 and Group2 are configured as shown in the following exhibi...

Author: Mia · Last updated Jul 15, 2026

You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect. You create a new Azure subscription. You discover that the synced on-premises user accounts cannot be assigned roles in the new subs...

To ensure that you can assign Azure and Microsoft 365 roles to the synced Azure AD user accounts, you need to address the issue of user synchronization and authentication between the on-premises Active Directory and the Azure AD tenant associated with the new Azure subscription. The primary issue here is that the synced on-premises user accounts are not being recognized for role assignments in the new subscription. Key Factors: - Azure AD Connect syncs on-premises Active Directory user accounts to Azure AD. - In order to assign Azure roles or Microsoft 365 roles, the users need to be in the same Azure AD tenant as the Azure subscription. - Role assignments require that the users are part of the correct authentication and identity system associated with the subscription. - Authentication methods like pass-through authentication and federated authentication only affect how users authenticate with Azure services but do not directly affect role assignments. - The new subscription may not be linked to the same Azure AD tenant as the existing one, which could be causing the issue with role assignments. Analysis of Each Option: A) Configure the Azure AD tenant used by the new subscription to use pass-through authentication: - Pass-through authentication allows users to authenticate against the on-premises Active Directory directly, without needing to store passwords in Azure AD. However, pass-through authentication does not solve the issue of users being unable to assign roles in the subscription because it does not address the fact that the user accounts may not be associated with the right Azure AD tenant. - Rejected because pass-through authentication only resolves authentication but does not affect role assignments. B) Configure the Azure AD tenant used by the new subscription to use federated authentication: - Federated authentication allows users to authenticate using their on-premises Active Directory credentials, typically through Active Directory Federation Services (AD FS)...

Author: Sam · Last updated Jul 15, 2026

You have an Azure subscription that contains an app named App1. App1 has the app registration shown in the following table. You need to ensure that App1 can read all user calendars and create appo...

To ensure that App1 can read all user calendars and create appointments while adhering to the principle of least privilege, we need to carefully choose the appropriate API permissions that allow the required operations. Let's break down each option based on the scenario. Key Factors: - Microsoft Graph API allows access to resources within Azure AD, including user calendars. - Delegated permissions are used when an app acts on behalf of a signed-in user, which is typically needed for user-specific actions like reading or modifying calendars. - Application permissions are used when the app needs to perform actions without user interaction, i.e., when it acts as a service or without any user context. - Least privilege requires us to select the permission that gives the necessary level of access to read and create calendar events, but without over-permissioning the app. Analysis of Each Option: A) Add a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite: - Calendars.ReadWrite allows the app to read and write calendar events on behalf of a signed-in user. Since this permission is delegated, it would allow App1 to perform actions as a user, which seems to match the requirement of reading and creating calendar appointments for users. - Selected because Calendars.ReadWrite allows the app to read all calendars and create appointments for users on their behalf, and it's a delegated permission, which fits the principle of least privilege when the app acts on behalf of a user. B) Add a new Application API permission for Microsoft.Graph Calendars.ReadWrite: - Calendars.ReadWrite as an Application permission allows the app to read and write calendar events, but without user interaction (i.e., the app can do this on its own without a user signing in). This would grant broader permissions tha...

Author: RadiantPhoenixX · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings: * Assignments: Include Group1, exclude Group2 * Conditions: Sign-in risk level: Low and above * Access: Allow access, Require multi-factor authentication You need to identify what occurs when the us...

Author: Alexander · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure subscription that contains an Azure SQL database named SQL1. You plan to deploy a web app named App1. You need to provide App1 with read and write access to SQL1. The solution must meet the following requirements: * Provide App1 with access to SQL1 without storing a password. * Use the principle of least privilege. * Minimize administrative effort. Which type of account should App1 use to ...

Author: Elijah · Last updated Jul 15, 2026

SNAPSHOT - You have an Azure Active Directory (Azure AD) tenant that contains two users named User1 and User2 and a registered app named App1. You create an app-specific role named Role1. You need to assign Role1 to User1 and enable User2 to request access to App1. Which two settings should you m...

Author: Ella · Last updated Jul 15, 2026

You have an Azure subscription that contains the resources shown in the following table. You plan to deploy the virtual machines shown in the following table. You need to assign managed identities to the virtual machines. The solution must meet the following requirements: * Assign each virtual...

To determine the minimum number of managed identities required, let's carefully analyze the requirements and the scenario: Key Factors: - Managed identities are Azure resources that provide an identity for Azure services to use when authenticating to other Azure resources. - Each virtual machine (VM) needs a managed identity to interact with other Azure resources securely, and each VM may require specific roles to perform its tasks. - The principle of least privilege implies that each virtual machine should have the smallest set of permissions required to perform its tasks, meaning each virtual machine gets only the roles it specifically needs. Analysis of Each Option: We would typically assign one managed identity per virtual machine (VM), as each machine may require different roles. However, the number of managed identities depends on whether the roles can be shared across multiple machines or if each machine needs a distinct identity for role assignment. A) 1 Managed Identity: - Rejected because using only one managed identity for all virtual machines would violate the principle of least privilege. Each VM needs a specific set of roles, and grouping them under one identity could grant unnecessary access that the VMs don't need, exposing them to excessive permissions. - A single identity would not meet the requirement of assigning specific roles to each VM. B) 2 Managed Identities: - Possible if the virtual machines can share a managed identity for similar roles. For example, if two virtual machines need the same set of roles (for instance, both machines need access to the same reso...

Author: Leo · Last updated Jul 15, 2026