MS-102: Password Policy and Guest Access Permissions

The question hinges on two distinct administrative permissions within Microsoft Entra ID (formerly Azure AD) under default external collaboration settings.

Task 1: Modify the password protection policy. Modifying the custom banned password list or on-premises password protection requires the Authentication Administrator role. The Global Administrator role also possesses this capability by virtue of its broad scope. Among the listed users, only User 1 (Global Administrator) and User 2 (Security Administrator) hold relevant roles. However, the Security Administrator role specifically allows configuring the custom banned password list but does not grant access to modify the broader password protection policy settings in the same way the Authentication Administrator does. More critically, standard exam doctrine distinguishes between 'Security Administrator' (who can manage password hashes/banned lists) and 'Authentication Administrator' (who manages password policies/protection). Since User 2 is a Security Administrator, they cannot modify the password protection policy. Only User 1 (Global Administrator) can perform this task among the choices provided.

Task 2: Create guest user accounts. The question specifies "default configuration" for external collaboration settings. By default, all users in the tenant have the ability to invite guests via B2B collaboration. This is a critical distinction: "Inviting" a guest sends an email invitation, whereas "Creating" a guest account manually requires higher privileges (like Global Admin or Guest Inviter). The prompt asks who can "Create guest user accounts," but in the context of default settings and typical exam traps, it often conflates the ability to initiate the guest journey (invite) with the manual creation. However, looking at the comments and official docs, there is a nuance. The comment stating "All users" refers to the ability to invite. If the question strictly means manually create a guest object in the directory without sending an invite first, that requires specific roles. But typically, "Create guest user accounts" in these HOTSPOT questions under default settings implies the default permission to send invitations which results in guest accounts. Wait, let's re-read carefully. "Create guest user accounts" vs "Invite". Official Microsoft documentation states that by default, all members can invite guests. To manually create a guest user (bypassing the invite flow), one needs the Guest Inviter role or higher.

Let's look at the most upvoted comment: "To CREATE (not invite) guest users... it's Global administrator and Guest Inviter roles... So User 1 and User 2." This suggests the question interprets "Create" as the action enabled by the Guest Inviter role or Global Admin. User 2 is Security Administrator. Does Security Admin have Guest Inviter rights? No. User 3 has no role. User 4 has no role. So only User 1 (Global Admin) can manually create. BUT, another high-vote comment says: "1. User 1 and User 2 2. All users". This aligns with the idea that Security Admin can do Task 1? No, we established Security Admin cannot modify password protection policy.

Let's re-evaluate Task 1. Can Security Admin modify password protection policy? Docs say: "Configure custom banned password list" is a Security Admin permission. It does NOT say "Modify password protection policy". That is an Authentication Admin task. So Task 1 is definitely User 1 only.

Let's re-evaluate Task 2. "Create guest user accounts". In many MS-102 contexts, if the setting is "Default", everyone can invite. If the question asks who can create, it usually targets the specific role requirement (Guest Inviter/Global Admin). User 1 is Global Admin. User 2 is Security Admin. User 3/4 are none. If the answer is "User 1 only", then why are there multiple slots?

Actually, there is a known trick here. The "Guest Inviter" role is separate from Security Admin. If the question implies the default behavior where everyone can invite, the answer might be "All Users" for the second box if the verb is interpreted loosely. However, the phrasing "Create guest user accounts" is specific. Let's look at the comment: "correct - Only Global Administrator or the Authentication Policy Administrator roles can modify the password protection policy... Another trick question". This implies Task 1 is User 1. For Task 2, if it's a trick about "Create" vs "Invite", and defaults allow inviting, does "Create" mean Invite? In Microsoft terminology, they are different. But in exam land, "Create guest user accounts" under default settings often points to All Users because the default external collaboration setting allows any member to invite guests, thereby creating them in the partner tenant.

Therefore:

1. Modify password protection policy: User 1 (Global Administrator).
2. Create (invite) guest user accounts: All Users (because of default settings).

Wait, looking at the exhibit image description isn't possible, but the text says "users shown in the following table". We have User 1 (Global), User 2 (Security), User 3 (None), User 4 (None). If the answer for Task 2 is "All Users", it includes 1, 2, 3, 4. If the answer is restricted to roles, it's just User 1. Given the "HOTSPOT" nature and the "default configuration" clue, the intended answer for Task 2 is almost certainly All Users (or Users 1, 2, 3, and 4) due to the default permission allowing guest invitations. Task 1 remains User 1.