Your organization wants to require that when an administrator activates the Security Administrator role in PIM, they must provide a justification and the activation must be approved by a specific group of managers. You need to configure this. What should you do?

In PIM, create an eligible assignment and then manually approve each activation request.

In PIM, create an active assignment for Security Administrator and set the approval requirement on the assignment.

In PIM, edit the role settings for Security Administrator and enable 'Require justification' and 'Require approval to activate'.

In Microsoft Entra ID, create a conditional access policy that requires approval for the Security Administrator role.

An administrator has an eligible assignment for the Security Administrator role in PIM. They need to activate the role, but the activation fails because they do not have a required approval. You need to troubleshoot the issue. What should you do?

Ask the administrator to sign out and sign back in to refresh their permissions.

Check the administrator's license to ensure they have a PIM license.

Check the PIM role settings to see if approval is required and whether the administrator is in the approver group.

Reassign the role as an active assignment to bypass the approval requirement.

A helpdesk manager needs to temporarily elevate to the Global Administrator role to perform a one-time tenant-wide configuration change. The company policy requires that all privileged access be time-limited and audited. You need to ensure the manager can perform the task without permanently holding the role. What should you do?

Make the manager eligible for the Global Administrator role in Microsoft Entra PIM and instruct them to activate the role when needed.

Assign the Global Administrator role to the manager permanently and rely on audit logs to track their actions.

Use Azure AD access reviews to grant the Global Administrator role to the manager for a limited time.

Create a custom role that includes all Global Administrator permissions and assign it to the manager for one day.

Your organization uses Microsoft Defender XDR. The security operations team needs to manage incidents and perform advanced hunting, but they should not be able to modify security policies or manage user accounts. You need to grant the appropriate permissions in the Microsoft Defender portal. What should you do?

Assign the Security Operator role in the Microsoft Defender portal to the security operations team.

Assign the Global Administrator role in Microsoft Entra ID to the security operations team.

Assign the Security Reader role in the Microsoft Defender portal to the security operations team.

Assign the Security Administrator role in Microsoft Entra ID to the security operations team.

Microsoft 365 Certified:Administrator Expert

Domain 1Objective 3

Manage Roles and Role Groups MS-102 Practice Questions (Page 1)

Part of the Deploy and manage a Microsoft 365 tenant domain, which accounts for 25–30% of the MS-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~10–20 in this domain), expect 3–7 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

8concepts

25–30%of the exam

Questions 1–5

1application · medium
Your organization wants to require that when an administrator activates the Security Administrator role in PIM, they must provide a justification and the activation must be approved by a specific group of managers. You need to configure this. What should you do?
Select an answer first
2expert · medium
An administrator has an eligible assignment for the Security Administrator role in PIM. They need to activate the role, but the activation fails because they do not have a required approval. You need to troubleshoot the issue. What should you do?
Select an answer first
3application · medium
A helpdesk manager needs to temporarily elevate to the Global Administrator role to perform a one-time tenant-wide configuration change. The company policy requires that all privileged access be time-limited and audited. You need to ensure the manager can perform the task without permanently holding the role. What should you do?
Select an answer first
4application · medium
Your organization uses Microsoft Defender XDR. The security operations team needs to manage incidents and perform advanced hunting, but they should not be able to modify security policies or manage user accounts. You need to grant the appropriate permissions in the Microsoft Defender portal. What should you do?
Select an answer first
5foundation · easy
You need to grant a security analyst permission to view incidents in Microsoft Defender XDR. Which role should you assign?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-102” is a trademark of its owner, used for identification only.

Manage Roles and Role Groups MS-102 Practice Questions (Page 1)

Questions 1–5

Your organization wants to require that when an administrator activates the Security Administrator role in PIM, they must provide a justification and the activation must be approved by a specific group of managers. You need to configure this. What should you do?

An administrator has an eligible assignment for the Security Administrator role in PIM. They need to activate the role, but the activation fails because they do not have a required approval. You need to troubleshoot the issue. What should you do?

You need to grant a security analyst permission to view incidents in Microsoft Defender XDR. Which role should you assign?

Keep studying — Deploy and manage a Microsoft 365 tenant