Q01 - Question
You plan group-based licensing. Licensed groups contain 1,200 unique members. The tenant has 1,000 licenses for the product. You want to meet licensing requirements. What should you do?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Obtain at least 200 more licenses.
- B. Keep 1,000 licenses because each group consumes one license.
- C. Set usage location on the groups.
- D. Move the members to Microsoft Entra ID Free.
A is correct.
Explanation: For groups assigned a license, you need at least one license for each unique member. 1,200 unique members require at least 1,200 licenses.
B is incorrect: Licenses are counted per unique member, not per group.
C is incorrect: Usage location is a user property and doesn't add licenses.
D is incorrect: Moving users doesn't provide product licenses.
Q02 - Question
A project team must create and manage all resource types in one resource group. The team must not grant access to others or receive access to other resource groups. Which role assignment meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Owner at the resource group scope
- B. Contributor at the resource group scope
- C. Contributor at the subscription scope
- D. User Access Administrator at the resource group scope
B is correct.
Explanation: Contributor can create and manage all types of Azure resources but can't grant access to others. Assigning it at the resource group scope limits access to that group.
A is incorrect: Owner includes the right to delegate access.
C is incorrect: Subscription scope is inherited by all resource groups.
D is incorrect: This role manages access rather than resources.
Q03 - Question
You will assign a policy with a deny effect to a production subscription. You must view compliance results first without blocking operations or changing the definition. What should you configure?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Set the policy definition effect to disabled.
- B. Assign the policy at the tenant root group.
- C. Delete the assignment after the first scan.
- D. Set enforcementMode to DoNotEnforce on the assignment.
D is correct.
Explanation: With enforcementMode set to DoNotEnforce, evaluation still runs but the policy effect isn't enforced. You can review compliance results before changing the mode to Enabled.
A is incorrect: The disabled effect prevents evaluation from happening at all.
B is incorrect: A wider scope increases the impact.
C is incorrect: Deleting the assignment removes the evaluation results.
Q04 - Question
A user has Office 365 Enterprise E1 assigned directly. The user joins a group that has Office 365 Enterprise E3 assigned. Group licensing reports a conflicting service plans error. Which action resolves the error?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Wait for Microsoft Entra ID to resolve the conflict automatically.
- B. Select Reprocess on the group without changing any assignment.
- C. Delete the group that has the E3 license.
- D. Remove the redundant direct E1 license, or disable the overlapping plans in the group's E3 assignment.
D is correct.
Explanation: The administrator decides how to resolve conflicting licenses. You can remove the redundant E1 license or disable overlapping plans in the E3 assignment.
A is incorrect: Microsoft Entra ID doesn't resolve license conflicts automatically.
B is incorrect: Reprocessing doesn't remove the conflict.
C is incorrect: A licensed group can't be deleted until its licenses are removed.
Q05 - Question
Engineers with the Owner role must still read and modify resources in a production resource group. You must prevent accidental deletion of the resource group's resources. Which configuration meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Apply a Delete lock to the resource group.
- B. Apply a ReadOnly lock to the resource group.
- C. Assign the Reader role to the engineers.
- D. Rely on Azure RBAC only, because locks apply to users without roles.
A is correct.
Explanation: A Delete lock lets authorized users read and modify resources but not delete them. The lock is inherited by resources in the resource group.
B is incorrect: A ReadOnly lock also blocks updates.
C is incorrect: Reader permissions don't allow modification.
D is incorrect: Locks apply regardless of RBAC permissions, including for owners.
Q06 - Question
You configure self-service password reset authentication methods. Which two methods are not recommended, either because fraudulent messages are possible or because answers might be known to other people? Select two.
Domain: Manage Azure identities and governance (20–25%) Type: Multiple choice
- A. Mobile app notification
- B. Mobile phone
- C. Email
- D. Security questions
B and D are correct.
Explanation: The mobile phone method isn't recommended because fraudulent SMS messages are possible. Security questions are the least recommended method because others might know the answers. Use them only with another method.
A is incorrect: Mobile app notification or code is recommended as the primary method.
C is incorrect: Email is suggested to support users without mobile devices.
Q07 - Question
Contoso has three Azure subscriptions. The same employees, groups, and applications must receive permissions in all three subscriptions. Which configuration meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Create a separate Microsoft Entra tenant for each subscription.
- B. Associate all three subscriptions with the same Microsoft Entra tenant.
- C. Associate each subscription with two Microsoft Entra tenants.
- D. Place each subscription inside a different resource group.
B is correct.
Explanation: A subscription is associated with exactly one Microsoft Entra tenant, and one tenant can serve multiple subscriptions. The same users, groups, and applications can then receive permissions in all three.
A is incorrect: Separate tenants create separate sets of identities.
C is incorrect: A subscription can't be associated with two tenants.
D is incorrect: Resource groups contain resources, not subscriptions.
Q08 - Question
An organization has 12 production subscriptions. It must restrict VM locations to one region. Subscription owners must not be able to override the restriction. Where should you assign the policy?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. On one resource group in each subscription
- B. On a Reader role assignment for each owner
- C. On a management group that contains the subscriptions
- D. On one subscription, then tag the others
C is correct.
Explanation: Subscriptions in a management group inherit its policy. A policy applied there is inherited by all subscriptions, and the resource or subscription owner can't override it.
A is incorrect: Resource group assignments don't cover each whole subscription.
B is incorrect: A role assignment doesn't enforce VM locations.
D is incorrect: Tags don't apply a policy to other subscriptions.
Q09 - Question
Employees use personal Android phones to read organizational email. Access must require an Intune compliance policy through Conditional Access. Users must not sign in with an organizational account to the device. Which device identity type fits?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Microsoft Entra registered
- B. Microsoft Entra joined
- C. Microsoft Entra hybrid joined
- D. Active Directory domain joined
A is correct.
Explanation: Microsoft Entra registered devices support BYOD and mobile devices, including Android. They don't require an organizational account to sign in to the device. Conditional Access applies when enrolled in Intune.
B is incorrect: Joined devices require an organizational account to sign in.
C is incorrect: Hybrid joined devices must be joined to on-premises Active Directory.
D is incorrect: Domain join doesn't fit personal phones.
Q10 - Question
A tenant must keep a Marketing security group current automatically. Any user whose Department attribute equals Marketing must be added or removed without manual updates. Which configuration meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Assigned membership type, with the group owner updating members.
- B. Dynamic Device membership type for the Marketing users.
- C. Dynamic User membership type, with a Microsoft Entra ID P1 license.
- D. Microsoft 365 group with Assigned membership type.
C is correct.
Explanation: Dynamic User membership adds and removes users based on rules that evaluate attributes such as department. Dynamic membership requires a Microsoft Entra ID P1 license.
A is incorrect: Assigned membership is maintained manually.
B is incorrect: Dynamic Device rules evaluate device attributes, not user attributes.
D is incorrect: Assigned membership is manual.