Free MS-102 flashcards

Which directory role grants the minimum permissions to add, modify, or remove a custom domain in Microsoft 365?

The Domain Name Administrator role. Adding or removing a domain affects the whole tenant, so Microsoft requires this dedicated role rather than generic helpdesk or user roles. Scoping a one-time DNS task to it avoids granting broader Global Administrator rights.

The User Administrator role can add a custom domain like contoso.com to a Microsoft 365 tenant.

User Administrator manages user accounts and licenses but cannot add tenant-scoped domains. Adding, modifying, or removing a domain affects the whole tenant and requires the Domain Name Administrator role.

Why might device protection features be absent from the Microsoft Defender portal for a Defender for Office 365-only customer?

The Defender portal surfaces only the security features a customer's subscription includes. Licensing is the gating factor, so with Defender for Office 365 but no Defender for Endpoint licence, device protection and the Endpoint device inventory are not shown. Turning on Defender XDR does not provision Endpoint, and roles control access to surfaced features rather than whether unlicensed features appear at all.

To see Defender for Endpoint device inventory you open a separate Endpoint portal in another browser session, distinct from the Defender portal.

There is no separate Endpoint portal. security.microsoft.com is the single unified Microsoft Defender surface. Device protection features are missing because the subscription lacks a Defender for Endpoint license - the portal only surfaces features for products you have licensed and provisioned.

What is the least-privileged role required to enable self-service password reset from the Microsoft Entra admin center?

Authentication Policy Administrator is the minimum role. It can open Entra ID then Password reset and change Properties, Authentication methods, Registration, Notifications, and Customization without being granted broader directory or user-management rights. Global Administrator also works but is not least-privileged.

The Authentication Administrator role is enough to turn on self-service password reset for the tenant in the Microsoft Entra admin center.

Authentication Administrator manages individual users' authentication methods and credentials, but it does not own the tenant SSPR configuration on the Password reset blade. Enabling SSPR requires at least the Authentication Policy Administrator role.

What two element categories must a custom sensitive information type pattern define?

Each pattern in a custom SIT requires a Primary element that triggers detection, and may add one or more Supporting elements that raise confidence when found within a defined character proximity. The primary element is mandatory; supporting elements are optional corroborating evidence near the match.

A custom sensitive information type pattern is built from a default classifier and a trainable classifier.

Trainable classifiers are a separate Purview content-classification mechanism and are not components of a SIT pattern. A custom SIT pattern requires a Primary element and may include one or more Supporting elements, each with their own character proximity.