Question 300 Users are in Cloud Sync scope, but a target group is not provisioned. What should be checked? Only the user's Intune compliance policy Change the group's SMTP alias while leaving Cloud Sync group support and filters untested Only a Defender for Office 365 quarantine rule Group provisioning support, filtering and configured object scope for the selected sync service Explanation Correct Answer D:User object success does not prove all group types and filters are supported. Incorrect Answers A:Device compliance does not create directory groups. B:An email alias does not determine whether the sync service supports and includes the group object in provisioning scope. C:Mail protection does not govern group object export.
Question 301 Two on-premises users have the same proxyAddresses value, and only one provisions to Entra. Which correction should precede another synchronization? Change the tenant's accepted domain Make the proxy address unique on authoritative source objects Force a delta cycle repeatedly Disable password hash synchronization Explanation Correct Answer B:Duplicate mail identities block consistent matching. Incorrect Answers A:Domain routing does not resolve object uniqueness. C:The unchanged collision persists across cycles. D:Passwords are unrelated to duplicate proxy addresses.
Question 302 An existing cloud user must be matched to an on-premises account during hybrid adoption. Which property requires careful mapping? The source anchor used to match the two identities The device's Intune ownership category Use a display name match when two workers happen to have similar names Use primary SMTP matching alone as the permanent immutable source identity anchor Explanation Correct Answer A:Stable identity correlation prevents unintended duplicate cloud users. Incorrect Answers B:Device metadata cannot match user accounts. C:Display names are nonunique and cannot safely establish object linkage between a cloud identity and an authoritative AD DS source. D:Primary addresses are mutable and do not replace supported source anchor handling for existing cloud-user matching.
Question 303 An inherited AD DS forest contains invalid UPN suffixes and duplicate attributes. What preparation is appropriate? Create parallel cloud users for each failed object Run identity attribute remediation using IdFix findings Enable tenant-wide password reset first Migrate all mailboxes before validating identities Explanation Correct Answer B:Fixing source errors reduces provisioning conflicts. Incorrect Answers A:Duplicates complicate the eventual source match. C:SSPR does not normalize source attributes. D:Mail migration cannot correct invalid identity data.
Question 304 Users have an internal non-routable UPN suffix and cannot get expected Microsoft 365 sign-in names. What should be planned? Disable directory synchronization after first import Modify the domain's mail-delivery records instead of establishing a verified sign-in UPN suffix Configure and use a verified routable UPN suffix in AD DS Change every user displayName to an email address Explanation Correct Answer C:Supported sign-in suffixes align synchronized identity with cloud domain. Incorrect Answers A:Stopping sync does not correct UPNs. B:SMTP delivery routing does not make an internal-only UPN suffix valid for the desired Microsoft 365 sign-in identity. D:Display names are not authentication suffixes.
Question 305 A synchronization dashboard reports export failures for only five accounts. What evidence narrows the cause? Re-run directory synchronization repeatedly after a few export failures without expanding the affected users' rejected attribute details Review per-object connector errors and rejected attributes Enable automatic device isolation on all computers Inspect the overall synchronization schedule without expanding the failed object's error details Explanation Correct Answer B:Specific export diagnostics identify the failing attributes. Incorrect Answers A:Repeated exports tend to reprocess the same invalid attributes; per-object errors reveal the correct remediation target. C:Endpoint response cannot repair directory connector errors. D:The scheduler may be healthy while only particular exports fail because of rejected attributes or object-level conflicts.
Question 306 A directory cleanup would remove thousands of cloud objects in one sync cycle. What safeguard should administrators verify? The desktop sign-in background image Raise the object export batch limit without inspecting the pending-deletion protection threshold The configured accidental-deletion prevention threshold and pending export count The default Power BI workspace capacity Explanation Correct Answer C:A threshold can stop unexpectedly broad deletions. Incorrect Answers A:Branding has no deletion-protection function. B:Export throughput has no bearing on accidental deletion protection when an unexpectedly large set of objects would be removed. D:Analytics capacity cannot stop identity deletions.
Question 307 A company wants to synchronize one pilot organizational unit before expanding hybrid identities. Which setting is appropriate? Give every employee the Cloud Application Administrator role Create a cloud-only pilot group without adding the intended source OU to Cloud Sync's configured filters Configure Cloud Sync scoping to include the pilot AD DS objects Set a tenant-wide DLP audit-only rule Explanation Correct Answer C:Filtering limits provisioned identities to the pilot. Incorrect Answers A:Privilege changes are unnecessary for source filtering. B:Targeting a cloud group does not automatically include the pilot's AD DS objects in the provisioning configuration. D:Compliance audit cannot scope directory replication.
Question 308 A branch Cloud Sync agent becomes unavailable during maintenance. What design reduces dependence on one agent host? Deploy supported additional agents in the same agent group Clone directory objects with new objectGUID values Increase retry frequency for the same offline agent instead of using supported agents on other hosts Move all users to a second Microsoft 365 tenant Explanation Correct Answer A:Multiple agents improve provisioning continuity. Incorrect Answers B:Duplicate identities would corrupt reconciliation. C:Faster retries do not provide independent redundancy when one agent host is unavailable for maintenance. D:Tenant duplication does not add agent resilience.
Question 309 Cloud Sync stopped exporting changes from one forest but other forests work. What should be checked first? Change the synced user display names across all forests without checking this forest's agent health The relevant provisioning agent service health and connectivity Rebuild user Outlook profiles while this forest's synchronization exporter remains unhealthy The number of Defender for Endpoint alerts Explanation Correct Answer B:A failed agent can block its assigned forest. Incorrect Answers A:Broad attribute edits cannot diagnose an outage limited to the provisioning path for a single source forest. C:Client mail profile settings do not control the cloud provisioning agent responsible for one forest's exported changes. D:Device alerts do not establish sync-agent state.
Question 310 An employee has an account in two source forests but should have one Microsoft 365 identity. What must be designed? Two separate cloud identities with identical UPNs Match source forest accounts by identical display name and assume they will automatically merge into one stable Entra user object Match multiple forest users solely by identical UPN text without defining source ownership Supported joining rules and source anchor ownership for one cloud user Explanation Correct Answer D:Cross-forest matching must avoid duplicate cloud identities. Incorrect Answers A:Duplicate UPNs cannot be used as a join strategy. B:Multi-forest joining requires documented rules and source-anchor ownership; names are neither reliably unique nor immutable. C:UPN matches can be ambiguous across forests and do not establish which object owns the one cloud identity.
