A company wants to enforce MFA for all users, but they have a group of users who use legacy authentication protocols (such as IMAP, POP3, or SMTP) that do not support MFA. What is the best approach to secure these users?

Block legacy authentication using Conditional Access, and require users to use modern authentication clients

Use SSPR to secure legacy authentication

Disable MFA for users who use legacy authentication

Allow legacy authentication but require MFA for all users

A company wants to use Microsoft Entra ID to manage access to a legacy on-premises application that does not support modern authentication protocols. They want to enable SSO for this application. What should they do?

Use Conditional Access to allow access to the application

Use Microsoft Entra Connect to sync the application's users

Use Microsoft Entra application proxy to publish the application and enable SSO

A company has a hybrid identity environment with Microsoft Entra Connect. They want to ensure that users who are disabled in on-premises AD DS are automatically blocked from accessing Microsoft 365. However, they have noticed that disabled users can still access Microsoft 365 for up to 30 minutes after being disabled. What is the most likely cause?

The users have cached credentials on their devices

The users are members of a group that grants access

The synchronization interval is set to 30 minutes

A company has a hybrid identity environment with Microsoft Entra Connect. They want to allow users to reset their own passwords from Microsoft 365, and have the new password written back to on-premises AD DS. What must be configured?

Password writeback in Microsoft Entra Connect

Seamless SSO in Microsoft Entra Connect

Microsoft Entra ID Protection sign-in risk policy

Contoso Pharmaceuticals has a Microsoft 365 tenant with 2,000 users. The security team wants to reduce the risk of account compromise for users who access email from mobile devices. They also want to avoid prompting users for additional verification when they are on the corporate network. Which two Microsoft Entra ID features should they configure together?

Conditional Access policy blocking all mobile device sign-ins, with a separate policy requiring MFA for corporate network access

Self-Service Password Reset (SSPR) enabled for all users, with MFA required only when resetting from a mobile device

Microsoft Entra ID Protection user risk policy requiring MFA for all sign-ins, with no location-based exceptions

Conditional Access policy requiring MFA for mobile device access, with a trusted-location exception for the corporate network

Microsoft Certified:Microsoft 365 Fundamentals

Domain 3Objective 1

Describe Identity and Access Management Solutions of Microsoft 365 MS-900 Practice Questions (Page 6)

Part of the Describe security, compliance, privacy, and trust in Microsoft 365 domain, which accounts for 25–30% of the MS-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~5–9 in this domain), expect 2–3 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

7concepts

25–30%of the exam

Questions 26–30

26expert · hard
A company wants to enforce MFA for all users, but they have a group of users who use legacy authentication protocols (such as IMAP, POP3, or SMTP) that do not support MFA. What is the best approach to secure these users?
Select an answer first
27expert · hard
A company wants to use Microsoft Entra ID to manage access to a legacy on-premises application that does not support modern authentication protocols. They want to enable SSO for this application. What should they do?
Select an answer first
28expert · hard
A company has a hybrid identity environment with Microsoft Entra Connect. They want to ensure that users who are disabled in on-premises AD DS are automatically blocked from accessing Microsoft 365. However, they have noticed that disabled users can still access Microsoft 365 for up to 30 minutes after being disabled. What is the most likely cause?
Select an answer first
29application · medium
A company has a hybrid identity environment with Microsoft Entra Connect. They want to allow users to reset their own passwords from Microsoft 365, and have the new password written back to on-premises AD DS. What must be configured?
Select an answer first
30application · medium
Contoso Pharmaceuticals has a Microsoft 365 tenant with 2,000 users. The security team wants to reduce the risk of account compromise for users who access email from mobile devices. They also want to avoid prompting users for additional verification when they are on the corporate network. Which two Microsoft Entra ID features should they configure together?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MS-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MS-900” is a trademark of its owner, used for identification only.

Describe Identity and Access Management Solutions of Microsoft 365 MS-900 Practice Questions (Page 6)

Questions 26–30

A company wants to enforce MFA for all users, but they have a group of users who use legacy authentication protocols (such as IMAP, POP3, or SMTP) that do not support MFA. What is the best approach to secure these users?

A company wants to use Microsoft Entra ID to manage access to a legacy on-premises application that does not support modern authentication protocols. They want to enable SSO for this application. What should they do?

A company has a hybrid identity environment with Microsoft Entra Connect. They want to allow users to reset their own passwords from Microsoft 365, and have the new password written back to on-premises AD DS. What must be configured?

Keep studying — Describe security, compliance, privacy, and trust in Microsoft 365