Task 1.1: Manage Microsoft Entra users and groups

• AAn administrative unit that is scoped to the department

  Incorrect

  Administrative units scope who can manage a set of users; they aren't a group whose membership follows an attribute for access.

• BA Microsoft Entra ID P1 license for each user who becomes a member

  Correct

  Dynamic membership groups require Entra ID P1 (or Intune for Education) for each unique user who is a member of one or more dynamic groups.

• CGroup-based licensing turned on for the new group

  Incorrect

  Group-based licensing hands out product licenses to a group's members; it doesn't make the membership itself rule-based.

• DThe Groups Administrator role assigned to the person who creates it

  Incorrect

  Groups Administrator can create and edit groups, but the role doesn't unlock dynamic membership on a Free tenant.

Dynamic membership is a premium feature. The tenant needs a Microsoft Entra ID P1 license (or Intune for Education) for every unique user who is a member of a dynamic group, although the licenses don't have to be assigned to those users.

• ACountry or region, under Contact information

  Incorrect

  Country or region is a contact detail; licensing checks the separate usage location setting, so filling this in doesn't clear the error.

• BOffice location, under Job information

  Incorrect

  Office location is a job detail shown in the directory; it plays no part in deciding which services can be licensed to the user.

• CPreferred language, under Settings

  Incorrect

  Preferred language sets the user's language for services; it isn't the location value that license assignment checks.

• DUsage location, under Settings

  Correct

  Some services aren't available in every country, so a license can't be assigned until the user's usage location is specified.

License assignment checks the usage location because some Microsoft services aren't offered everywhere. A user assigned through a group inherits the tenant's location when none is set, but a direct assignment needs the property on the user first.

• ALimit guest invites to specific admin roles, and assign the coordinator Guest Inviter

  Correct

  With that setting only User Administrators and Guest Inviters can invite, and the Guest Inviter role lets the coordinator keep inviting.

• BLimit guest invites to specific admin roles, and make the coordinator a group owner

  Incorrect

  Group ownership doesn't let a user invite external users once invitations are restricted to admin roles.

• CSet guest invites to no one in the organization, and assign the coordinator Guest Inviter

  Incorrect

  The no-one setting blocks invitations for everyone, administrators included, so the coordinator would be blocked as well.

• DAdd the partner domain to the allow list, and leave guest invites unchanged

  Incorrect

  An allow list limits which domains can be invited; it doesn't change who in your tenant may send invitations, so every member could still invite.

Guest invite settings decide who may invite. The setting "Only users assigned to specific admin roles can invite guest users" leaves invitations to User Administrators and Guest Inviters, and the Guest Inviter role is the narrow way to give one non-admin that ability.

• ASecurity questions need the number of required methods set to two

  Incorrect

  Security questions work as the single required method for ordinary users; the problem appears only for accounts in admin roles.

• BHelpdesk Administrators are excluded from SSPR until you scope a group

  Incorrect

  Administrator accounts are enabled for SSPR by default; they're subject to a different policy, not excluded.

• CAdmin roles get a fixed two-gate policy that bans security questions

  Correct

  Accounts in Entra administrator roles use a strong two-gate policy that needs two methods and prohibits security questions, and it can't be changed.

• DSecurity questions need password writeback when the user is an admin

  Incorrect

  Writeback sends reset passwords to on-premises AD DS; it has nothing to do with which methods an admin can use.

Administrator accounts are enabled for SSPR with a default two-gate policy that differs from the user policy. It requires two pieces of authentication data, such as email, an authenticator app or phone, and prohibits security questions.

• ABulk invite in the Users page, with a CSV of email addresses

  Correct

  Bulk operations > Bulk invite takes a CSV of email addresses and invitation preferences and sends B2B invitations.

• BMicrosoft Graph PowerShell running New-MgInvitation over a CSV

  Correct

  Importing the CSV and calling New-MgInvitation for each row invites every user and can send the invitation email.

• CBulk create in the Users page, with a CSV of the partner users

  Incorrect

  Bulk create makes new internal accounts in your tenant; it doesn't invite external users to sign in with their own accounts.

• DMicrosoft Entra Connect cloud sync from the partner directory

  Incorrect

  Cloud sync provisions users from your own on-premises AD DS; it doesn't invite users of another organization.

• EGuest invite settings changed to let anyone in the organization invite

  Incorrect

  That setting only widens who may invite; it doesn't send a single invitation.

Bulk invitations can be sent from the admin center with Bulk invite and a CSV template, or scripted with Microsoft Graph PowerShell by looping New-MgInvitation over a CSV.

• ADelete her guest account and invite kim@fabrikam.com

  Incorrect

  A new invitation creates a new user object, so the old account's group memberships and app assignments would have to be rebuilt.

• BAdd kim@fabrikam.com to her Other emails and wait for her next sign-in

  Incorrect

  The address is a preparation step only; she keeps signing in with the identity she redeemed with until her redemption status is reset.

• CReset her redemption status so she redeems again with her work account

  Correct

  Resetting redemption reinvites the same user object, keeping its object ID, group memberships and app assignments, and her sign-in name changes to the new email.

• DChange her user principal name to kim@fabrikam.com

  Incorrect

  The UPN isn't the identity a guest signs in with; even after a reset the guest's UPN stays the same.

When a guest has to sign in with a different email or identity provider, or has moved to another company but needs the same access, you reset the redemption status in the user's profile (or with PowerShell or the Microsoft Graph invitation API). The user redeems a new invitation and keeps the same object, so nothing has to be reassigned. Deleting and reinviting was the older workaround.

• ADynamic membership on the project groups

  Incorrect

  Dynamic membership changes who is in a group; it never deletes the group.

• BA group naming policy

  Incorrect

  A naming policy enforces prefixes and blocked words; it doesn't remove old groups.

• CA Microsoft 365 group expiration policy

  Correct

  An expiration policy sets a lifetime for Microsoft 365 groups and asks owners to renew; groups that aren't renewed are deleted.

• DAn Azure Policy assignment that deletes unused groups

  Incorrect

  Azure Policy governs Azure resources, not Microsoft Entra groups, so it can't expire or delete them.

An expiration policy gives Microsoft 365 groups a lifetime. Owners are notified to renew, and a group that isn't renewed expires and is deleted, remaining restorable for 30 days.

• AThe consultant's role to Guest Inviter

  Incorrect

  Guest Inviter lets a user invite guests; it doesn't change the user's own directory privileges.

• BThe consultant's User type from Guest to Member

  Correct

  User type controls guest or member privileges for that account, while the consultant keeps signing in with the external identity.

• CThe tenant's guest user access to the same access as members

  Incorrect

  That setting applies to every guest in the tenant, not one person.

• DThe guest invite settings to allow member users to invite

  Incorrect

  Invite settings decide who may invite; they don't change an existing guest's access.

An external user can be an external member: they authenticate with their own account but have member privileges. Changing the user type on one account does that without widening access for all guests.

• ANotifications: Notify users on password resets

  Incorrect

  This sends an email after a reset; it doesn't drive registration.

• BCustomization: a custom helpdesk link

  Incorrect

  A custom link points users to help; it doesn't prompt them to register.

• CAuthentication methods: set the number of methods required to two

  Incorrect

  Requiring more methods makes reset stronger but doesn't prompt anyone to register.

• DRegistration: Require users to register when signing in

  Correct

  With this set to Yes, users in scope are prompted to register their authentication information at sign-in.

The Registration page of SSPR can require users to register when signing in, and sets how often they reconfirm their information.