Question 220 A help desk admin has a User Administrator role scoped to a regional administrative unit. Why can't they change an unrelated executive user? The user has a personal OneDrive site The tenant has more than one verified domain The executive user isn't in the role's administrative unit scope Extend the regional User Administrator's permanent role to the entire tenant rather than confirm whether the executive is outside the administrative-unit scope Explanation Correct Answer C:Scoped role authority is limited to included directory objects. Incorrect Answers A:Site presence does not define AU membership. B:Domain count does not override administrative unit scoping. D:Broader role assignment could grant access but abandons least-privilege regional administration instead of addressing the scoped boundary.
Question 221 A company wants delegated administrators to reset passwords only for users in one business division. What is the essential difference between an administrative unit and an ordinary group? AU scope can restrict supported administrative role assignments to managed objects A security group automatically grants its owners tenant-wide password reset rights An Exchange mail group can restrict Global Administrator automatically A Microsoft 365 Group replaces Entra role-based administration Explanation Correct Answer A:A normal group membership list alone does not create scoped directory role authority. Incorrect Answers B:Group ownership is not a directory role assignment. C:Mail distribution membership does not constrain global role privileges. D:Collaboration groups are not the privileged role scoping construct.
Question 222 A responder needs to handle Defender incidents for a defined device group but not every endpoint. Which layer should be evaluated? Purview eDiscovery case membership alone Grant the responder organization-wide Security Administrator in Entra without enforcing the narrower Defender device-group scope Supported Defender XDR role-based access and device scope permissions A Microsoft 365 Group's public/private setting only Explanation Correct Answer C:Defender permissions can be scoped separately from broad Entra roles. Incorrect Answers A:Legal case roles cannot grant Defender device response scope. B:A tenant-wide directory role does not preserve the intended Defender incident RBAC limitation to a specific set of devices. D:Group visibility is not Defender incident RBAC.
Question 223 A user has Security Reader in Entra but cannot edit a Purview sensitivity label policy. What should an administrator assess? Grant the user Security Administrator in Microsoft Entra and assume it covers every Microsoft Purview sensitivity-label policy editor permission The account's Teams meeting lobby settings The user's Office update ring The relevant Purview role group and permissions for label policy editing Explanation Correct Answer D:Workload RBAC can require roles beyond Entra Security Reader, which is read-only. Incorrect Answers A:Security roles and Purview role groups have different action capabilities; verify the exact Purview administration role. B:Meetings do not authorize label policy edits. C:Desktop app servicing does not define Purview RBAC.
Question 224 A legal investigator needs search access to a specific eDiscovery case but not every case in the tenant. What permission design is most relevant? A public SharePoint library link to legal data Tenant Global Administrator for the duration of every investigation Case membership and supported eDiscovery permissions scoped to that investigation Exchange message trace admin only Explanation Correct Answer C:Case-scoped authority limits access to unrelated legal matters. Incorrect Answers A:Anonymous content sharing is incompatible with controlled investigations. B:Full tenant privilege exceeds the case search requirement. D:Mail trace is not complete Purview eDiscovery case authorization.
Question 225 An admin holds Global Reader but cannot use an advanced licensed security feature for their own work. Why might this happen? A Purview label is required for administrator portal access Upgrade the administrator's Entra role from Global Reader to Global Administrator and assume that grants all licensed premium security features Administrative RBAC and product/service entitlement are independent conditions The user's default tenant domain always prohibits premium features Explanation Correct Answer C:A read role does not automatically supply every paid feature license. Incorrect Answers A:Content labels do not grant feature subscriptions. B:Wider RBAC does not by itself supply the applicable premium product entitlement; privilege and licensing are distinct conditions. D:UPN suffix does not universally dictate security licensing.
Question 226 A tenant has 45 permanently assigned Global Administrators although most only manage Exchange or Teams. What is the most important remediation direction? Move all admin accounts to a public Microsoft 365 Group Replace broad standing roles with task-specific and eligible just-in-time roles Delete organization-wide service health notifications Make all 45 accounts share one strong password Explanation Correct Answer B:Least privilege and PIM reduce the impact of compromised admin accounts. Incorrect Answers A:Group visibility does not safely govern privileged directory roles. C:Notifications do not reduce role abuse exposure. D:Shared credentials destroy individual accountability.
Question 227 A tenant maintains emergency administrator accounts for severe authentication outages. Which practice is essential? Use one shared daily administrator mailbox account Use the same password as ordinary help desk accounts Define controlled monitoring, exceptional access use and periodic validation Grant all guests emergency Global Administrator Explanation Correct Answer C:Emergency accounts need defensible access and detection for misuse. Incorrect Answers A:Routine shared use undermines emergency control. B:Credential reuse compromises emergency access integrity. D:Guests have no broad emergency need for tenant-wide access.
Question 228 An incident responder activated Global Administrator for emergency remediation and the outage is resolved. What should happen next? Leave the emergency Global Administrator activation active until its maximum TTL without documenting whether the remediation requirement has ended Make the responder the permanent owner of every Microsoft 365 Group End the activation and verify no unnecessary lasting privileged assignments remain Delete the tenant service health incident records Explanation Correct Answer C:Emergency elevation must not become permanent standing access. Incorrect Answers A:Emergency permissions should end once work is complete, with residual elevated assignments checked; waiting for expiration prolongs exposure. B:Group ownership is unrelated to the emergency role requirement. D:Removing evidence impairs the incident postmortem.
Question 229 A privileged role's activation requires strong authentication, but the user's normal session used only a password. What should the admin configure? Remove the privileged role's activation MFA requirement for this administrator because they had signed in using a valid password earlier An Exchange transport spam rule for the admin's email A SharePoint sharing link expiration setting An appropriate PIM activation authentication requirement consistent with policy Explanation Correct Answer D:Role elevation should meet the configured assurance level rather than relying on password-only session. Incorrect Answers A:A normal session may not meet the additional authentication assurance configured for sensitive PIM role activation. B:Mail filtering cannot satisfy authentication assurance. C:File link expiry does not protect role activation.
Question 230 An organization requires an independent approver for PIM Global Administrator activation. Which governance design avoids a conflict? Allow each requestor to approve their own elevation Configure a distinct authorized approver and audit activation decisions Use Outlook message forwarding as the sole approval control Disable PIM activation auditing to avoid paperwork Explanation Correct Answer B:Independent approval provides accountability separate from the requestor. Incorrect Answers A:Self-approval defeats the requested independent review. C:Forwarding an email does not enforce PIM role activation approval. D:Removing audit records weakens the control.
