Question 230 An organization requires an independent approver for PIM Global Administrator activation. Which governance design avoids a conflict? Allow each requestor to approve their own elevation Configure a distinct authorized approver and audit activation decisions Use Outlook message forwarding as the sole approval control Disable PIM activation auditing to avoid paperwork Explanation Correct Answer B:Independent approval provides accountability separate from the requestor. Incorrect Answers A:Self-approval defeats the requested independent review. C:Forwarding an email does not enforce PIM role activation approval. D:Removing audit records weakens the control.
Question 231 A user belongs to a role-assignable group but cannot perform a directory administration task. What should be checked? Whether the appropriate role assignment and active eligibility are actually effective Whether the group's mail alias is primary Whether a Defender anti-phishing policy lists the group Whether the user's mailbox has an archive enabled Explanation Correct Answer A:Group membership alone does not guarantee an active role or correct assignment scope. Incorrect Answers B:SMTP aliases do not define privileged role activation. C:Mail policy targeting does not activate Entra administrative roles. D:Mailbox archive state does not activate directory privileges.
Question 232 An analyst needs to investigate Defender alerts but only a separate manager may edit protection policies. Which design fits? Share the manager's credentials when an alert occurs Assign Global Administrator to every analyst Delete role audit history after each incident Use scoped read/investigation permissions separate from policy-write role assignments Explanation Correct Answer D:Segregation avoids giving every investigator security policy modification rights. Incorrect Answers A:Shared credentials defeat segregation and attribution. B:Broad privilege allows unrelated configuration changes. C:Audit deletion undermines enforcement and review.
Question 233 A regional help desk can edit German user profiles but not a company-wide group containing those users. Why could that be valid? Germany's users must have a separate Microsoft 365 tenant Being German automatically grants Global Administrator The target group itself may not fall within the assigned administrative scope Add the regional administrator to the company-wide group as a member and assume that also grants ownership outside their administrative-unit scope Explanation Correct Answer C:Object scope applies to what the role may administer, not simply to all its members. Incorrect Answers A:AUs support scope within one tenant. B:Geography does not confer tenant-wide role authority. D:Group membership does not override the administrative scope defining which directory objects this role holder can manage.
Question 234 An identity governance lead must manage Entra administrator role assignments but does not need full tenant-wide service management. Which role is most appropriate? License Administrator for group service plans Privileged Role Administrator with approved scoped assignment User Administrator limited to ordinary employee profiles Authentication Administrator for nonprivileged users Explanation Correct Answer B:This role manages directory role assignments while avoiding unrelated global service administration. Incorrect Answers A:License role controls subscriptions rather than directory administrator assignments. C:User lifecycle privileges do not generally cover privileged role assignment administration. D:Authentication method support does not provide broad privileged role governance.
Question 235 An integration team must manage enterprise application credentials and registrations without configuring all tenant security settings. Which role family is relevant? Reports Reader for security dashboards Cloud Application Administrator for supported app-management tasks Groups Administrator for group ownership only Exchange Administrator for mail connectors Explanation Correct Answer B:The app role covers application administration without unrestricted Global Administrator powers. Incorrect Answers A:Report viewing does not rotate or manage application credentials. C:Group management does not cover application registrations broadly. D:Messaging rights do not manage Entra application credentials.
Question 236 A developer needs to administer assigned Entra app registrations and consent settings under policy. Which privileged capability should be considered? Application Administrator where its supported permissions match the task Password Administrator for standard users Global Reader for configuration inspection Teams Administrator for meetings Explanation Correct Answer A:Application-specific administration is narrower than Global Administrator. Incorrect Answers B:User password reset does not manage app registration owners and secrets. C:Read-only role cannot edit app settings. D:Teams policy authority does not cover general Entra registrations.
Question 237 A device team needs to manage Intune configuration profiles without controlling Exchange mail flow. Which workload role fits? Exchange Administrator with organization management Compliance Reader for Purview labels Intune Administrator with appropriate scope Billing Administrator Explanation Correct Answer C:Device management permissions can be delegated without Exchange or Global Administrator. Incorrect Answers A:Messaging roles cannot administer Intune profiles. B:Content governance read access does not deploy devices. D:Subscription purchasing is not endpoint policy administration.
Question 238 A security engineer must modify tenant authentication-method policies, not reset one user's methods. What should they seek? Only an Exchange Recipient Administrator role A role with authority over authentication-method policy configuration Only a Helpdesk Administrator role scoped to a few users Only a Reports Reader role Explanation Correct Answer B:Policy management permissions differ from help desk user-method reset permissions. Incorrect Answers A:Recipient administration cannot modify Entra authentication-method policies. C:User reset permissions do not imply tenant authentication policy writes. D:Reading authentication reports is not policy editing.
Question 239 A team needs to manage Entra Conditional Access policies but not every Entra configuration area. Which role should be evaluated? License Administrator SharePoint Administrator Conditional Access Administrator with controlled privileges Authentication Administrator for user reset only Explanation Correct Answer C:CA policy administration can be delegated separately from Global Administrator. Incorrect Answers A:Product entitlements do not grant policy-edit rights. B:Site management does not create Entra CA policies. D:User method reset and CA policy modification are different tasks.
Question 240 An operator must create, delete and manage allowed group types across a department without managing tenant secrets. Which role is relevant? Billing Administrator Cloud Application Administrator Groups Administrator with any required scope constraints Security Reader Explanation Correct Answer C:Group governance can be delegated without unrestricted Global Administrator permissions. Incorrect Answers A:Subscription billing does not govern group lifecycle. B:App registration management is not a substitute for group administration. D:Security dashboards do not confer directory group modification rights.
