A company uses Microsoft Entra ID Free and wants to enforce MFA for all users. They have a mix of users who have never registered for MFA and some who have. They want to ensure that all users are prompted to register for MFA at their next sign-in. What is the simplest way to achieve this?

Enable security defaults in Microsoft Entra ID.

Use per-user MFA settings to require MFA for each user.

Deploy Azure AD Identity Protection to require MFA.

Create a Conditional Access policy requiring MFA for all users.

Fabrikam is migrating from an on-premises Active Directory to Microsoft Entra ID. They want users to access Microsoft 365, Salesforce, and a custom line-of-business app with a single set of credentials. The custom app supports SAML 2.0. You need to minimize the number of times users enter passwords. What should you configure?

Register the custom app in Microsoft Entra ID and configure SAML-based SSO.

Set up federation between on-premises AD and Microsoft Entra ID using AD FS.

Use password hash synchronization and require users to re-enter passwords for each app.

Create a new user account for each application and sync passwords.

Which tool in Microsoft Entra ID provides a visual summary of risky sign-ins and users flagged for risk?

Microsoft Entra Admin Center dashboard

A user is unable to sign in, and the sign-in logs show the status 'Interrupted' with a risk level of 'Medium'. The user is required to use MFA. You need to identify the cause of the interruption. What should you review?

The user's password last change date

The risk detection details in the Microsoft Entra sign-in logs

The Microsoft 365 service health dashboard

An administrator notices that a user's account was assigned the Global Administrator role at 2:00 AM. The user denies making this change. You need to determine whether the role assignment was made through a PIM activation or a direct assignment, and who performed it. What should you do?

Check the user's sign-in logs for the time of the role assignment.

Review the Microsoft Entra audit logs for role assignment events and PIM activation events.

Use the Identity Secure Score report to see role changes.

Review the Microsoft 365 Defender alerts for the user.

Microsoft 365 Certified:Copilot and Agent Administration Fundamentals

Domain 1Objective 3

Identify the Core Security Features of Microsoft 365 Services AB-900 Practice Questions (Page 3)

Part of the Identify the core features and objects of Microsoft 365 services domain, which accounts for 30–35% of the AB-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~6–11 in this domain), expect 2–4 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

9concepts

30–35%of the exam

Questions 11–15

11application · medium
A company uses Microsoft Entra ID Free and wants to enforce MFA for all users. They have a mix of users who have never registered for MFA and some who have. They want to ensure that all users are prompted to register for MFA at their next sign-in. What is the simplest way to achieve this?
Select an answer first
12application · medium
Fabrikam is migrating from an on-premises Active Directory to Microsoft Entra ID. They want users to access Microsoft 365, Salesforce, and a custom line-of-business app with a single set of credentials. The custom app supports SAML 2.0. You need to minimize the number of times users enter passwords. What should you configure?
Select an answer first
13foundation · easy
Which tool in Microsoft Entra ID provides a visual summary of risky sign-ins and users flagged for risk?
Select an answer first
14application · medium
A user is unable to sign in, and the sign-in logs show the status 'Interrupted' with a risk level of 'Medium'. The user is required to use MFA. You need to identify the cause of the interruption. What should you review?
Select an answer first
15expert · hard
An administrator notices that a user's account was assigned the Global Administrator role at 2:00 AM. The user denies making this change. You need to determine whether the role assignment was made through a PIM activation or a direct assignment, and who performed it. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AB-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AB-900” is a trademark of its owner, used for identification only.