Configure and manage a Microsoft Entra tenant
Objective configure.manage-entra-tenant sits in Implement and manage user identities, which carries 22% of the Identity and Access Admin exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A company runs a legacy line-of-business application that authenticates using Kerberos and NTLM, and it cannot be rewritten to use modern authentication. The company wants to move it to the cloud. Which Microsoft Entra product should it use?
The concept
Cloud identity products mostly speak token-based protocols, and an application that cannot be rewritten does not speak them. The question is therefore not which product is most modern but which one still answers the old wire protocols an unmodified binary will emit: ticket-based authentication, challenge-response, directory lookups over LDAP, and policy delivery.
Why this answer
The application depends on Kerberos and NTLM, which only Microsoft Entra Domain Services provides as a managed domain service, letting Microsoft deploy and maintain the core service components.
- Correct: this is the product designed for legacy apps that cannot use modern authentication methods.
- BWorkload ID governs authentication for applications, services, and containers, not legacy Kerberos/NTLM domain authentication.
- CPrivate Access secures remote connections to internal corporate resources without a VPN, not domain authentication protocols.
- DID Governance automates access requests, assignments, and reviews, not domain-level authentication protocols.
- EVerified ID issues and verifies digital credentials, unrelated to Kerberos or NTLM authentication needs.
Now you: objective configure.manage-entra-tenant questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A tenant administrator holds only Microsoft Entra ID P1 licenses. The admin creates a Conditional Access policy that requires multifactor authentication whenever the sign-in risk level is medium or high, then saves it as report-only. What happens?
Sample question 2 of 3
A security admin at a company wants Conditional Access to automatically require multifactor authentication only when Microsoft Entra ID Protection reports a medium or high sign-in risk level. Which license is required to build this risk-based policy?
Sample question 3 of 3
A tenant's Microsoft Entra ID P1 licenses expire while several Conditional Access policies are still enabled. An admin opens the Policies page the next day. What happens to the existing policies and what can the admin still do?
Full Identity and Access Admin question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.