Question 120 A batch of hires cannot receive a subscription because all seats are consumed. What should licensing staff do? Delete Microsoft 365 Service health history Assign a more privileged Entra role to each hire Check purchased versus assigned license capacity and acquire or free eligible seats Override license assignment errors for all hires without acquiring seats or reusing eligible entitlements from departing employees Explanation Correct Answer C:License assignment requires available entitlement capacity for new users. Incorrect Answers A:Historical incident entries cannot create subscription seats. B:Directory role escalation does not create additional seats. D:Licensing cannot be made effective by bypassing unrelated checks; capacity must match seats consumed by valid user assignments.
Question 121 HR provides a validated list of 350 new employee accounts to provision automatically. Which administrative interface supports scripted directory creation at scale? Create Exchange mail contacts for the 350 new hires through a transport connector rather than actual cloud directory user accounts A Microsoft Defender malware policy exception Microsoft Graph PowerShell with appropriate scoped permissions Create 350 separate custom-domain DNS TXT ownership records and assume the tenant automatically provisions the listed accounts Explanation Correct Answer C:Graph PowerShell can automate bulk user operations through supported APIs. Incorrect Answers A:SMTP connectors and contacts support mail delivery, not creation of authenticating users with Microsoft 365 service entitlements. B:Malware rules cannot create user identities. D:Domain verification is performed for namespaces, not individual employee identities; user objects need directory provisioning commands.
Question 122 A bulk script is about to disable hundreds of accounts after an HR export changed column order. What is the critical safety step? Disable audit logging to reduce execution overhead Run the HR bulk-disable script against the entire tenant using the previous file's positional columns, then correct any errors Assume the HR export's column offsets are unchanged and execute against all users Validate input mappings and test on a controlled sample before applying the full change Explanation Correct Answer D:Incorrect column mapping can cause broad destructive identity actions. Incorrect Answers A:Removing audit evidence increases risk and does not validate inputs. B:With changed input structure, unvalidated field positions can target unintended users; a preflight mapping and controlled test are required. C:A reordered CSV header can cause incorrect target-account updates unless columns are validated on a small safe sample.
Question 123 A script only needs to read user and group membership data. How should its Graph permission model be selected? Use the minimum applicable Graph read scopes with appropriate consent Grant the Graph automation an Exchange Online administrator role rather than selecting the needed Microsoft Graph directory read scopes Use a globally privileged directory application scope to simplify read-only user/group queries, despite the script requiring no writes Grant every available Graph application permission Explanation Correct Answer A:Read-only tasks should not require write permissions or blanket administration. Incorrect Answers B:Exchange role delegation does not substitute for the Microsoft Graph permission grants required for reading users and groups. C:Broad application access violates least privilege and creates exposure well beyond the stated read-only automation requirement. D:Excess application scopes expand the security impact of compromise.
Question 124 An automation depends on an obsolete Azure AD PowerShell cmdlet for bulk identity edits. What modernization direction is appropriate? Migrate the unsupported Azure AD identity automation into Exchange Online PowerShell recipient commands for every directory object Plan migration to supported Microsoft Graph or Entra PowerShell commands Replace Azure AD directory write cmdlets with Exchange Online mailbox cmdlets, regardless of whether the edited objects are mail-enabled Rebuild the bulk identity changes as a Microsoft Purview data lifecycle job instead of migrating to supported Graph or Entra commands Explanation Correct Answer B:Supported modules provide a maintainable path for Entra operations. Incorrect Answers A:Exchange cmdlets cannot replace supported identity and group management functions exposed through Microsoft Graph or Entra PowerShell. C:Exchange recipient administration is not a general replacement for Microsoft Graph user and group identity operations. D:Retention jobs govern content lifecycle, not creation and modification of directory user and group attributes.
Question 125 A cloud user signs in to Entra but cannot open a paid Microsoft 365 workload. What distinction should be checked first? Reset the user's cloud password and issue a new session token before checking whether the paid workload service plan is active Clear the user's Outlook cached credentials without checking their effective service plan Recheck the tenant's preferred UPN suffix although the user already authenticates successfully Entra account authentication versus required workload licensing and service-plan enablement Explanation Correct Answer D:Directory sign-in alone does not entitle a user to every Microsoft 365 service. Incorrect Answers A:Successful Entra sign-in already establishes authentication; a missing service plan or provisioning state is the more relevant access layer. B:Client credentials might cause sign-in failures but do not establish whether the authenticated identity has the required paid service enabled. C:UPN suffix configuration can affect identity, but successful sign-in points first toward workload entitlement and enabled service plans.
Question 126 A user changed departments and the company's Global Address List should reflect the new department name. Where should the source attribute be updated? Edit the user's Exchange Online mailbox display name only, even though the department field is synchronized from on-premises AD DS In Microsoft Defender Safe Links settings In the authoritative identity directory for that user, cloud or synced as applicable Change the employee's Outlook client contact-card cache rather than the department property in the user object's authoritative directory Explanation Correct Answer C:Directory profile attributes feed the user record seen by connected workloads. Incorrect Answers A:A mailbox display-name change does not update the department attribute at its authoritative identity source. B:URL protection cannot change user directory metadata. D:A client cache can affect display temporarily but does not update the directory department value propagated into the organizational address list.
Question 127 An employee is departing immediately; the organization must stop access while retaining the account for handoff. Which action is more direct than changing the password alone? Delete the custom email domain from the tenant Block sign-in and revoke sessions under the departure procedure Remove the employee's product license before revoking sessions, assuming loss of entitlement immediately terminates every issued sign-in token Reduce the employee's OneDrive retention period Explanation Correct Answer B:Containment should address new authentication and existing sessions without deleting resources prematurely. Incorrect Answers A:A domain removal affects many users and does not target one leaver. C:Licensing changes are not a dependable substitute for explicit account block and session revocation during an urgent departure. D:Retention changes may compromise handoff data without stopping access.
Question 128 A department needs a group to assign access to a protected SharePoint resource without automatically creating a mailbox. Which group is appropriate? An Exchange mail contact A shared mailbox used as a list of user IDs An Entra security group with scoped resource permissions Create an Entra administrative unit with the department users and treat that management boundary as a SharePoint access group Explanation Correct Answer C:Security groups support authorization independently of mailbox creation. Incorrect Answers A:A mail contact does not carry the intended membership-based access rights. B:A shared mailbox is for delegated email access, not standard group authorization. D:Administrative units scope administrator operations; they do not directly replace a security group assigned resource permissions.
Question 129 A sensitive project group should not accept arbitrary self-join requests. Which governance control matters most? Disable Microsoft 365 Apps updates for the group Allow anyone to join the sensitive Microsoft 365 Group but limit each member's tenant role to Global Reader afterward Make the group public and rely on its SharePoint site's external sharing settings to prevent unapproved members from joining Use an approved membership process and controlled group ownership Explanation Correct Answer D:Membership authority should match the protected project's access requirements. Incorrect Answers A:Client servicing does not govern resource membership approvals. B:Read-only directory privileges do not prevent the group from granting access to its sensitive project resources. C:Site external sharing restrictions and group membership governance are distinct; the group itself still needs controlled approvals.
Question 130 An administrator assumes adding a group to another licensed group always passes inherited product licenses through any nested membership depth. What should be verified? Inspect the parent group's dynamic membership rule but assume nested licensing is supported Whether the nested group has an Exchange address alias that matches the parent group's email domain Whether the licensing mechanism supports the intended direct membership and nesting behavior Whether all group members share the same UPN suffix Explanation Correct Answer C:Licensing eligibility must be verified rather than assuming nested groups inherit every license. Incorrect Answers A:Membership evaluation alone does not prove that nested memberships pass product entitlement through group-based licensing. B:Mail addresses do not determine the supported direct membership requirements of Entra group-based licensing. D:UPN domain does not establish nested licensing semantics.
