AB-900 — frequently asked questions

No. Conditional Access policies control who can access resources based on conditions. They do not assign or grant software licenses.

It typically takes up to 24 hours, though it often happens within minutes. Direct assignment is usually instantaneous.

Yes, you can configure risk policies to automatically block users or require step-up authentication (like MFA) when high-risk sign-ins are detected.

ID Protection focuses on cloud sign-in risks and automated remediation, while Defender for Identity monitors on-premises Active Directory for lateral movement and compromise indicators.

No, the Global Reader role is strictly read-only. It does not allow creating, modifying, or deleting users or any other resources.

No, Global Reader cannot read Teams chat messages. Access to chat content requires specific compliance or eDiscovery roles.

No. You must use a mail-enabled security group. Regular security groups are not recognized by Exchange Online as recipients for permission assignments like Full Access.

Yes. Microsoft Entra ID supports assigning Microsoft 365 licenses to standard security groups, allowing all members to inherit the license automatically.

A mail-enabled security group has an email address and appears in the Exchange address book, allowing it to be used for mailbox permissions and email distribution. A standard group does not.

No. You cannot block specific external domains or URLs from Copilot's web search results. You can only disable web search entirely for all users.

Administrators can disable web search (grounding) for Copilot via the Microsoft 365 admin center under Copilot settings. This forces Copilot to rely only on enterprise data.

No, notebooks are primarily designed for individual use. While you can share files, they do not offer the same governance, security, and centralized management features as a custom agent for organizational-wide deployment.

In a custom agent, you explicitly connect Site1 as a data source and configure the system prompt to instruct the agent to only use information from that source for its responses.

Insider Risk Management focuses on user behavior and actions, such as downloading large amounts of data or accessing restricted files, often using signals from various sources. Communication Compliance scans the content of messages (email, chat, Teams) for specific keywords or patterns that violate policies.

Yes, Insider Risk Management can detect and alert on risky actions involving removable media, such as copying sensitive files to a USB drive, especially when configured with the appropriate alerts and device control integrations.

An app registration provides a Client ID, allows for the creation of client secrets or certificates, and defines the API permissions the service can request.

No. Conditional Access policies apply to user sign-ins. Third-party services authenticate using credentials associated with their App Registration (Service Principal).

It measures how well you have implemented identity-related security controls in Microsoft Entra ID, providing recommendations to reduce risks.

You can improve it by enabling multi-factor authentication, reducing the number of Global Administrators, enforcing strong password policies, and implementing Conditional Access.

Sign-in logs include user identity, application, date/time, location, IP address, device info, and the reason for success or failure, including Conditional Access outcomes.

No. While Defender may correlate identity risks, the primary source for viewing raw sign-in attempt logs is the Microsoft Entra admin center.

Yes, by default, Members can share files and folders with external users, provided the tenant's external sharing settings allow it.

Only Site Owners and Site Collection Administrators can add or remove users from the site. Members cannot invite users to the site.

No. License assignment is performed in the Microsoft 365 admin center under Users > Active users. The Exchange admin center only manages the mailbox object and settings.

Custom domains are added and verified in the Microsoft 365 admin center under Domains. This process involves updating DNS records at your domain registrar.