Plan, implement, and manage Microsoft Entra user authentication
Objective entra.user-authentication sits in Implement authentication and access management, which carries 28% of the Identity and Access Admin exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A security administrator wants sign-ins automatically challenged for multifactor authentication whenever Microsoft Entra ID Protection evaluates a sign-in as medium or high risk. Which capability should the administrator configure to achieve this?
The concept
Authorization controls and authentication controls answer different questions, and a question about what happens at sign-in is never solved by a permission grant. Deciding what a principal may do to a resource is one axis. Deciding whether the person at the keyboard should be challenged again before anything is granted is the other, and only that axis can consume a probability score about the sign-in itself.
Why this answer
Sign-in risk becomes actionable only when a policy names it as a condition. A risk-based Conditional Access policy reads the level Microsoft Entra ID Protection calculates and attaches a grant control to it, so a medium or high score produces a multifactor challenge without an administrator intervening.
- Correct: risk level in, step-up challenge out.
- BContributor role assignment is an Azure RBAC concept for managing resource access, not a way to trigger MFA on risk.
- CDomain Services enables Kerberos and NTLM for legacy apps and has no role in risk-based sign-in evaluation.
- DCustom role definitions and deny assignments are RBAC authorization concepts, unrelated to sign-in risk detection.
Now you: objective entra.user-authentication questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An organization is moving a line-of-business application to the cloud. The application only supports Kerberos and NTLM and cannot use modern authentication methods. Which action should the identity administrator take so the application keeps functioning after the move?
Sample question 2 of 3
What is the stated purpose of self-service password reset for an organisation?
Sample question 3 of 3
With single sign-on in place and Microsoft Entra ID as the identity provider, what changes for the applications involved?
Full Identity and Access Admin question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.