Microsoft AZ-104 - Microsoft Azure Administrator - Manage Azure Identities and Governance - Manage Microsoft Entra users and groups - Review Questions

AZ-104: Manage Microsoft Entra Users and Groups

1. An organization synchronizes users from AD DS to Microsoft Entra ID. It wants cloud password sign-ins to continue working during an on-premises network outage. Which authentication method best meets this requirement?

A. Password writeback

B. Federation with on-premises AD FS

C. Password Hash Synchronization

D. Pass-through Authentication

2. A company has disconnected AD forests and wants cloud-managed synchronization with multiple active lightweight on-premises agents. Which solution fits?

A. AD FS federation

B. Microsoft Entra Domain Services

C. Connect Sync with a staging server

D. Microsoft Entra Cloud Sync

3. A department needs a shared mailbox, calendar, SharePoint site, and the option to add Teams. Which group type should you create?

A. Microsoft 365 group

B. Assigned security group

C. Dynamic device security group

D. Distribution list

4. You need a group that automatically contains users whose Department property is Finance. Which configuration should you use?

A. Microsoft 365 group with Dynamic Device membership

B. Security group with Dynamic User membership

C. Security group with Assigned membership

D. Security group with Dynamic Device membership

5. A synchronized user's Department property is authoritative in on-premises AD DS. Where should an administrator normally update it?

A. The on-premises AD DS user object

B. The user's authentication-method settings

C. The user's application profile only

D. The Entra group description

6. You need to change a cloud security group's name while preserving its existing identity and references. What should you do?

A. Replace its Object ID with a new identifier

B. Delete the group and recreate it with the new name

C. Create a new group and copy only its owners

D. Edit the existing group's name in Properties

7. A user receives the same product through a direct assignment and a licensed group. You remove only the direct assignment. What happens, assuming the group assignment remains valid?

A. The tenant's purchased license quantity decreases

B. The user is automatically removed from the group

C. The user retains the product through the group

D. All assignments for the product are removed

8. A licensed group contains a nested security group. A user belongs only to the nested group. Will the user inherit the parent group's license?

A. Yes, after the user completes MFA

B. Yes, if the nested group has an owner

C. No, the user must be a member of the licensed group itself

D. Yes, because all security-group nesting propagates licenses

9. An administrator disables an unnecessary service plan inside a user's product license. What is the intended effect?

A. The entire product license becomes available for another user

B. The user's Entra account is disabled

C. The selected service entitlement is disabled while the product remains assigned

D. The tenant purchases a smaller subscription automatically

10. A staff member should only invite external guests. Invitations are restricted to designated administrator roles. Which role best follows least privilege?

A. License Administrator

B. User Administrator

C. Guest Inviter

D. Global Administrator

11. Which statement best describes a typical Microsoft Entra B2B collaboration user?

A. They use existing credentials and have a user object in the resource tenant

B. They receive access to all applications after invitation redemption

C. They access resources without any representation in the resource tenant

D. They must receive a new password from the resource tenant

12. A licensed synchronized member is enabled for SSPR and has enough valid verification methods registered. What additional capability lets a cloud password reset update AD DS?

A. Configured and functioning password writeback

B. Dynamic group membership

C. Password Hash Synchronization alone

D. Guest self-service sign-up

13. SSPR requires two verification methods. A user has only one qualifying method registered. What should you expect?

A. The user can use the same method twice

B. The user cannot complete SSPR until sufficient methods are available

C. Entra automatically reduces the requirement to one

D. Password writeback bypasses identity verification

14. A company laptop must remain joined to AD DS for Group Policy and machine authentication while also gaining an Entra device identity. Which state fits?

A. MAM without enrollment

B. Microsoft Entra joined only

C. Microsoft Entra hybrid joined

D. Microsoft Entra registered only

15. Employees use personal phones. IT must restrict copying work data into personal apps and selectively remove corporate app data without requiring MDM enrollment. Which approach fits?

A. Entra device registration alone

B. AD DS Group Policy only

C. Intune MAM with app protection policies

D. Full device wipe as the standard removal action

Question	Correct answer	Explanation
1	C - Password Hash Synchronization	Entra validates passwords in the cloud without live on-premises connectivity.
2	D - Microsoft Entra Cloud Sync	Supports cloud-managed synchronization, lightweight agents, and disconnected forests.
3	A - Microsoft 365 group	Provides shared collaboration resources such as a mailbox, calendar, and SharePoint site.
4	B - Security group with Dynamic User membership	Automatically evaluates user attributes such as Department.
5	A - The on-premises AD DS user object	Update a synchronized attribute at its authoritative source.
6	D - Edit the existing group’s name in Properties	Renaming preserves the group’s Object ID and existing references.
7	C - The user retains the product through the group	Removing the direct assignment leaves the valid group-based assignment intact.
8	C - No—the user must be a member of the licensed group itself	Group-based licensing does not propagate through nested groups.
9	C - The selected service entitlement is disabled while the product remains assigned	Disabling an included service plan does not release the product license seat.
10	C - Guest Inviter	Provides invitation permissions without broader administrative privileges.
11	A - They use existing credentials and have a user object in the resource tenant	B2B retains the external identity while creating a representation for access management.
12	A - Configured and functioning password writeback	Sends supported cloud password resets back to AD DS.
13	B - The user cannot complete SSPR until sufficient methods are available	The user must satisfy the configured verification requirement.
14	C - Microsoft Entra hybrid joined	Retains AD DS domain membership while adding an Entra device identity.
15	C - Intune MAM with app protection policies	Protects corporate application data without requiring MDM enrollment.