MS-102 — Frequently Asked Questions

No. Passwordless phone sign-in with Microsoft Authenticator is limited to iOS and Android devices, so it cannot serve the Windows devices named in this scenario.

Windows Hello for Business is a device-bound Windows credential that relies on the PC's TPM plus PIN or biometrics, so it is unavailable on Android and iOS.

The Authenticator app works best when paired with a trusted device. Joining or registering the device ensures the system recognizes the hardware, enabling stronger security checks and Conditional Access policies.

No. Certificate-based auth is a credential type. To manage and deploy these certificates securely in an enterprise, you typically need the devices to be managed via Intune or joined to Entra ID.

Administrative Units delegate permissions and management scope. They do not provide a filtering interface for viewing or prioritizing Secure Score recommendations.

Yes, you must assign the created tag to specific users or devices before it appears as an available filter option in the Secure Score view.

Windows Hello for Business is only supported on Windows devices and cannot authenticate Android or iOS users.

Standard MFA often uses passwords plus another factor. Passwordless MFA typically refers to methods like FIDO2 or the Authenticator app push.

The Authenticator app handles user verification, but passwordless methods like Windows Hello for Business require the device itself to be trusted and registered with Entra ID.

Workgroup devices can register for basic MFA, but advanced passwordless features like FIDO2 or Windows Hello for Business require the device to be joined to Entra ID.

Sign-in risk evaluates the authentication attempt or session, such as an anonymous IP or atypical travel, not compromised stored credentials. Leaked credentials are user risk, and only a user risk policy applies the 'Require password change' remediation.

No. Password protection only blocks weak or banned passwords, and SSPR merely lets users reset their own password. Neither detects leaked credentials or forces a password change based on risk.

The receiver type (FTP, FTPS, Syslog UDP/TCP/TLS) is part of the data source definition on the Data sources tab, while the log collector record stores its name, host IP/FQDN, and associated data source(s).

Yes, but you configure it when creating the data source, not when creating the log collector; the question asks specifically about log collector components.

The executive report provides a broad, scheduled overview for management, while the snapshot report offers focused, date-range-specific detail needed to identify the most-used apps in the last 30 days.

The dashboard shows live data, but generating a snapshot report gives you a shareable, time-bound analysis specifically for the last 30 days, which directly answers the question.

Onboarding packages are scripts/configs for Windows and macOS sensors. iOS uses the Microsoft Defender for Endpoint app from the App Store.

It means adding the Microsoft Defender for Endpoint iOS store app in the Intune Admin Center and assigning it to user groups.

App connectors provide API-based activity and file visibility; access policies need real-time session control, which requires Conditional Access App Control instead.

No, Entra ID registration alone is not enough; you must deploy Conditional Access App Control to App1 before creating an access policy.

The app connector is how MDCA ingests Office 365 activity, but with mailbox audit logging off there is no Exchange mailbox activity for it to surface, so the mailbox setting is the required first step.

No. Activity policies only filter and alert on activity already logged in MDCA, so mailbox audit logging must be enabled before a policy can ever see mailbox events.

A landing page controls the web page shown after a user clicks the simulated link; it does not compose the phishing email, its link, or the message branding.

No. Global payloads are Microsoft built-in templates that cannot be modified; create a tenant payload when you need a custom link, sender, or company terminology.

No, it is a temporary state that can be toggled on or off as needed for troubleshooting or configuration.

No, device groups manage policy assignments but do not bypass the runtime enforcement of tamper protection on individual endpoints.

Strict protection does cover those workloads, but it is tuned aggressively for high-value or priority users, not as a balanced baseline. The scenario asks for the baseline profile, which is Standard protection.

Apply the Standard preset security policy, which Microsoft defines as the baseline profile suitable for most users and includes anti-spam, anti-phishing, anti-malware, Safe Links, and Safe Attachments.

The Defender portal is for incidents, alerts and advanced hunting; baseline profiles are created and targeted to device groups as Intune endpoint security profiles.

The Microsoft 365 E5 subscription in the scenario already includes Intune and Defender for Endpoint, so both the baseline templates and the Intune admin center are available.

No. Endpoint DLP applies to onboarded Windows 10 1809+, Windows 11, Windows Server 2019/2022 and macOS only; Android and iOS protection comes from the separate mobile DLP capability using the Defender for Endpoint app.

Yes, macOS is a supported Endpoint DLP platform, but since the question lists only Windows 11, Android and iOS, Windows 11 remains the single correct choice.

Reports Reader can view sign-in and audit reports but does not include the Identity Protection risky users list. Security Reader is the read-only security role for that data, so D is not correct.

Global Administrator grants full tenant control and far exceeds the review-only requirement. Security Administrator provides the needed Identity Protection access with fewer privileges.

Exposure score rates the attack surface risk of devices and identities in Defender Vulnerability Management. It never compares tenant configuration to Microsoft baselines or produces improvement actions.

Yes. Secure Score aggregates recommendations across Microsoft 365 services, including Defender for Cloud Apps, so some improvement actions relate to cloud app governance.

The item was written when multi-account passwordless phone sign-in was documented for iOS only. Android parity came later, which is why some learners call the question obsolete.

Yes. Each work or school account can be added to the same Authenticator install, and passwordless phone sign-in can be enabled per account on a supported platform.

Synced users are mastered on-premises, so Entra attributes such as city are read-only in the cloud and any direct change is overwritten by the next synchronization cycle.

No, but the Active Directory PowerShell module must be installed. Option A's domain controller wording is still valid because only on-premises AD is authoritative for the synced city attribute.

Microsoft 365 uses a TXT record to prove you own the public domain; NS records delegate DNS authority, which is not required for simple domain verification.

No. PTR records provide reverse DNS lookup from IP to hostname and are not used by Microsoft 365 to validate a custom domain.

The template configures Microsoft Defender Antivirus protection update behavior, which is delivered only to supported Windows clients, so any non-Windows entry has no settings to receive.

It controls how Defender Antivirus protection updates (security intelligence) are obtained and applied, such as update source, frequency and channels, on managed Windows devices.

Sentinel only appears on the Incidents page when explicitly connected to Defender XDR; Defender for Identity is a default integrated source in a Microsoft 365 tenant.

Defender for Cloud can integrate, but it is not a native Microsoft 365 Defender incident source by default, so it is not the expected answer for a standard tenant.

Keywords are not supported in every DLP workload; endpoint DLP and Teams chat do not offer the keyword condition, while sensitive info types are universal across the locations.

Sensitivity labels are a condition in some workloads like Exchange and SharePoint, but they are not available for all locations in the exhibit, so they are not the correct universal choice.

SharePoint site alerts are scoped to a single site and usually notify the alert creator about item changes, so they cannot notify an HR manager whenever any department user shares a file or folder.

Use a Microsoft Defender for Cloud Apps activity policy, which can detect SharePoint and OneDrive sharing events and send an email alert to the manager.

Simulation mode identifies which emails match the sensitive info type and would be encrypted, letting you validate the rule without enforcing encryption prematurely.

Simulation mode only reports matches and does not apply encryption; turning the policy on enforces the sensitivity label and encryption on matching emails.

Endpoint rule actions come from the DLP agent on Windows and macOS devices, not from cloud storage. OneDrive accounts only exposes file and sharing conditions for cloud files.

No. That location is for the information protection scanner discovering files on file shares, so it never surfaces USB, copy, or network-share endpoint actions.

C:\Windows is a core, non-temporary folder, so only the Full – remediate threats automatically level cleans threats there without approval.

Yes. User download and temp paths count as temporary folders, so a threat there is auto-remediated at the non-temp folders level.

Endpoint DLP only onboards Windows 10/11 and macOS devices. Android and iOS protection uses Intune app protection policies and Purview DLP for cloud apps such as Exchange Online, SharePoint and OneDrive.

No. Licensing enables the DLP service, but device support is defined by the platform list Microsoft publishes for Endpoint DLP, which does not include Android or iOS.

Enhanced filtering only lets Exchange Online trust the last-hop IP and SPF handling of an on-premises connector so hybrid mail is filtered correctly. It never revisits or deletes messages that were already delivered.

Yes. Malware ZAP is controlled from the anti-malware policy family in the Microsoft Defender portal; spam and phishing ZAP live in the anti-spam policy. Malware ZAP is on by default but can be toggled.

An EDR policy only onboards Windows 11 devices to Defender for Endpoint and configures investigation, remediation and tamper protection settings. Blocking process creation requires an ASR rule, which is delivered through an attack surface reduction policy.

No. Safe Documents opens untrusted files in Protected View in Defender for Office 365 and has no control over whether Word, Excel or Outlook spawn child processes on the endpoint, so the ASR recommendation stays open.

Learning hub only provides security awareness content; it cannot create the password-reset phishing simulation or track users who click the link like attack simulation training does.

It records payload link clicks and can automatically assign or suggest follow-up training to users who interact with the simulated message.

Yes. Standard is the preconfigured balanced profile in Defender for Office 365 preset security policies; Strict is the more aggressive profile that quarantines more.

The scenario asks for a balanced baseline, not maximum protection. Strict delivers stronger, quarantine-heavy settings, exceeding the stated requirement.

Many learners believe automatic onboarding requires the Defender for Endpoint connector in Intune, but an assigned EDR policy also delivers the onboarding configuration to targeted devices.

Yes. The policy is assigned to a device group, so existing and newly enrolled Windows devices in that group receive the Defender for Endpoint onboarding settings.

No. Co-management only lets Configuration Manager and Intune manage the same device and workload split; it does not push the Defender for Endpoint onboarding configuration.

An Endpoint Detection and Response (EDR) policy in Intune, together with the Defender for Endpoint connector, delivers the onboarding configuration when the device enrolls.

Yes. Microsoft's MDM onboarding guidance lists both a custom configuration policy and an EDR policy, so the older custom OMA-URI profile method remains supported.

They assume only the EDR policy or the Defender for Endpoint connector can onboard devices. The question only requires automatic onboarding at Intune enrollment, which the configuration profile provides.

A session policy can enforce real-time controls like block printing inside the proxied App1 session, whereas an activity policy is for detecting or alerting on activities after they occur.

No. OAuth app policies govern app permissions and consent, while Cloud Discovery anomaly detection policies flag unusual shadow IT usage; neither blocks printing from a Conditional Access App Control session.

A snapshot report is a static, point-in-time export of discovery data. It adds no status field to the app itself, so the cloud app catalog cannot later display an audited-apps list from it.

Tag each app after its audit, for example "Audited", then filter or group the Cloud app catalog or discovered-app queries by that tag to show only the audited apps.

Fifteen days belongs to other simulation fields such as due-date or reminder counts, not to the maximum training availability window, which is 30 days after the simulation ends.

The training assignment simply expires for that user, so the simulation's failure record stands alone and no further training content is served from that campaign.

The more-aggressive level lowers the bar: medium-confidence phishing detections are treated as very high confidence, so a medium-PCL message such as Mail2 is actioned by Policy1 as well.

Yes. That setting enables impersonation protection for User1, so messages that spoof her identity are classified as phishing on top of the PCL-based detections.

C is not factually wrong, but D is the better answer because it fully specifies the Microsoft Defender portal and matches Microsoft's documented path for custom detection rules.

No. A Purview DLP policy governs data handling, and an alert suppression rule hides matching alerts; neither creates a new Defender for Endpoint alert for malicious device activity.

Reports Reader only covers usage and sign-in/audit reporting surfaces. It does not include the Identity Protection risk detections permission, so the Risky users blade stays inaccessible.

No. User Administrator manages user objects and group membership but has no permission to read Identity Protection risk data, and it would exceed least privilege for a review task.

Safe Attachments detonates files in a sandbox and acts on malware verdicts or unknown-malware timeouts. It has no list where you can name .apk and .appx, so it cannot satisfy an extension-based quarantine requirement.

In the policy's Common attachment types filter, add each extension as a custom file type and set the action to Quarantine. Messages carrying those attachment types are then quarantined for review.