Microsoft MS-100 - Questions & Answers

Contoso plans to provide email addresses for all the users in the following domains:
1. East.adatum.com
2. Contoso.adatum.com
3. Humongousinsurance.com

To verify three domain names, you need to add three TXT records.

References:
https://docs.microsoft.com/en-us/office365/admin/setup/add-domain?view=o365-worldwide

User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Security Reader role can view reports.
The Compliance Management role can schedule the email delivery of security and compliance reports.

References:
https://docs.microsoft.com/en-us/exchange/permissions-exo/permissions-exo

User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Security Administrator role can view reports but not schedule the email delivery of security and compliance reports.
The View-Only Organization Management role cannot schedule the email delivery of security and compliance reports.

References:
https://docs.microsoft.com/en-us/exchange/permissions-exo/permissions-exo

User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Security Reader role can view reports but not schedule the email delivery of security and compliance reports.
The Help Desk role cannot schedule the email delivery of security and compliance reports.

References:
https://docs.microsoft.com/en-us/exchange/permissions-exo/permissions-exo

User2 must be able to view reports and schedule the email delivery of security and compliance reports.

The Records Management role cannot view reports or schedule the email delivery of security and compliance reports.
The Help Desk role cannot schedule the email delivery of security and compliance reports.

References:
https://docs.microsoft.com/en-us/exchange/permissions-exo/permissions-exo

User4 must be able to reset User3 password.

User3 is assigned the Customer Lockbox Access Approver role. Only global admins can reset the passwords of people assigned to this role as it's considered a privileged role.

References:
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Customer-Lockbox-Approver-Role-Now-Available/ba-p/223393

The members of Group1 must be required to answer a security question before changing their password.

If SSPR (Self Service Password Reset) is enabled, you must select at least one of the following options for the authentication methods. Sometimes you hear these options referred to as "gates."

1. Mobile app notification
2. Mobile app code
3. Email
4. Mobile phone
5. Office phone
6. Security questions

You can specify the required authentication methods in the Password reset properties of the Azure AD tenant. In this case, you should set the required authentication method to be 'Security questions'.

References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

Vendors must be able to authenticate by using their Microsoft account when accessing Contoso resources.

You can invite guest users to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest user must then redeem their invitation to access resources. An invitation of a
user does not expire.
The invitation will include a link to create a Microsoft account. The user can then authenticate using their Microsoft account. In this question, the vendors already have Microsoft accounts so they can authenticate using them.

References:
https://docs.microsoft.com/en-us/azure/active-directory/b2b/add-users-administrator

Vendors must be able to authenticate by using their Microsoft account when accessing Contoso resources.

You can invite guest users to the directory, to a group, or to an application. After you invite a user through any of these methods, the invited user's account is added to Azure Active Directory (Azure AD), with a user type of Guest. The guest user must then redeem their invitation to access resources. An invitation of a
user does not expire.
The invitation will include a link to create a Microsoft account. The user can then authenticate using their Microsoft account. In this question, the vendors already have Microsoft accounts so they can authenticate using them.

In this solution, we are creating guest account invitations by using the New-AzureADMSInvitation cmdlet and specifying the -InvitedUserEmailAddress parameter.

Note:
There are several versions of this question in the exam. The question has two possible correct answers:
1. From the Azure portal, create guest accounts.
2. From Azure Cloud Shell, run the New-AzureADMSInvitation cmdlet and specify the -
InvitedUserEmailAddress parameter.

Other incorrect answer options you may see on the exam include the following:
1. From the Azure portal, modify the authentication methods.
2. From the Azure portal, add an identity provider.

References:
https://docs.microsoft.com/en-us/azure/active-directory/b2b/add-users-administrator
https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation?view=azureadps-2.0