Question 320 Accounts were moved to an excluded OU and then disappeared from cloud scope. What best explains the result? Create new cloud-only accounts for all removed users without examining the excluded organizational-unit synchronization filter Cloud mailboxes automatically disable OU filtering The user count exceeded a Defender incident threshold The configured organizational-unit filter no longer includes those source accounts Explanation Correct Answer D:Object moves across filter boundaries affect provisioning scope. Incorrect Answers A:New accounts can break identity continuity; the OU filter is what moved the original synchronized objects out of scope. B:Mailbox state is not the source filter. C:Security incidents are not the directory filter.
Question 321 Only employees with Department=Sales should synchronize, yet Finance accounts appear in Entra. What should be inspected? The configured attribute-filter expression and its applied object scope The SharePoint external sharing default A Defender cloud app session policy Disable accidental deletion protection and rerun the connector, assuming a safeguard was the cause of unexpected Finance inclusion Explanation Correct Answer A:Incorrect filter rules can include unexpected accounts. Incorrect Answers B:Sharing preferences do not select synchronized users. C:Session controls do not perform source identity filtering. D:Deletion safeguards do not explain why Finance objects satisfy a Sales-only attribute filter; inspect expression and scope.
Question 322 A synchronized user's display name is edited in Entra but later reverts to the old value. What is the probable cause? The backup service resets identity attributes daily Exchange mail flow rules reject the display name A Defender threat indicator resets names An on-premises authoritative attribute overwrites the cloud edit on export Explanation Correct Answer D:Source-controlled properties must be changed in the authoritative directory. Incorrect Answers A:Backup is not the normal attribute authority. B:Transport rules do not update this directory field. C:Indicators are unrelated to directory field writeback.
Question 323 Cloud accounts already exist with the same email as incoming AD DS users, and synchronization creates unexpected joins. What must be examined? A new Teams app permission policy The device compliance grace period Soft-match eligibility and conflicting identity attributes before synchronization A larger Exchange message-size limit Explanation Correct Answer C:Matching depends on compatible cloud and source identifiers. Incorrect Answers A:App policy does not identify source users. B:Compliance settings do not join directories. D:Message size cannot resolve identity matching.
Question 324 An administrator intentionally aligns a cloud account to a specific on-premises user using an immutable identifier. What must remain consistent? Soft-match the cloud object by display name even though the required source anchor may reference a different on-premises identity Match the cloud identity to the source account by primary SMTP address alone even if its immutable source anchor differs The endpoint security tamper protection mode The cloud on-premises immutable ID and source anchor for that source object Explanation Correct Answer D:A stable anchor identifies the matching source account. Incorrect Answers A:Display names are not authoritative immutable join keys; sourceAnchor and cloud immutable ID determine persistent identity alignment. B:Email addresses can change or collide; the immutable sourceAnchor determines durable synchronization identity matching. C:Device protection does not map cloud users.
Question 325 A hybrid user changes surname and sign-in identity. Where should a source-authoritative UPN modification usually be initiated? In a new Power BI semantic model In the authoritative on-premises directory, then synchronize the change By creating a second verified domain each time By editing a Defender incident title Explanation Correct Answer B:Source ownership avoids cloud edits being overwritten. Incorrect Answers A:Analytics metadata cannot change AD DS users. C:New domains are unnecessary for user renames. D:Incident text is not an identity attribute.
Question 326 A user is synchronized to Entra but old on-prem password changes do not work for cloud sign-in under PHS. What should be checked? Only the user's Purview label permissions Only the tenant network connectivity score Password hash sync feature health and the affected account's processing errors Only the recipient's Exchange mailbox size Explanation Correct Answer C:Object sync success does not guarantee password hash synchronization. Incorrect Answers A:Label access cannot repair hash synchronization. B:General network score is not a password processing report. D:Mailbox size does not propagate passwords.
Question 327 A user was disabled in AD DS, yet cloud sign-in should be blocked promptly after synchronization. Which state must be checked? Whether source accountEnabled state has propagated to the cloud object The mailbox's auto-reply configuration The device's Defender attack surface reduction exceptions Remove the synchronized user's product licenses and assume existing sessions end when licensing changes propagate Explanation Correct Answer A:A synchronized disable should affect cloud sign-in eligibility. Incorrect Answers B:Automatic replies do not disable identity access. C:ASR exceptions are not cloud account state. D:License removal is not the definitive proof of blocked sign-in; inspect accountEnabled propagation and session controls.
Question 328 A large source move triggers an export deletion limit, leaving stale identities in Entra. What is the least risky immediate action? Delete every affected user from Entra manually Disable the accidental-deletion threshold so all pending source-scoping deletions export, without reviewing what caused the mass move Review pending deletions and source scoping before changing safeguards Disable the safeguard permanently and export immediately Explanation Correct Answer C:The threshold may be blocking an erroneous bulk delete. Incorrect Answers A:Manual deletion compounds the potential error. B:A deletion threshold may be protecting the cloud against unintended mass removals; inspect pending objects and scope first. D:Bypassing protection before review risks mass deletion.
Question 329 A company has several AD DS forests and wants lightweight agent-based hybrid provisioning. What should it evaluate first? An Exchange transport rule for every forest A unique Microsoft 365 tenant for each branch user Microsoft Entra Cloud Sync support and configuration per source forest A security label for each domain controller Explanation Correct Answer C:The supported agent model may avoid a full Connect Sync host. Incorrect Answers A:Mail routing cannot synchronize identities. B:Separate tenants hinder centralized identity management. D:Content labels do not provision users.
Question 330 An attribute arrives in Entra with unexpected capitalization or formatting after a new rule. Which information identifies the transformation? Defender endpoint exposure score alone SharePoint storage usage charts Recipient safe-links rewrite settings Attribute-mapping rule evaluation and source/target values for the object Explanation Correct Answer D:Mapping logic determines exported property values. Incorrect Answers A:Device exposure cannot explain directory transformations. B:Storage charts cannot show identity mappings. C:Link protection is unrelated to identity formatting.
