MS-102 Flashcards
(348 cards)
1
Q
A
2
Q
To see DLP Alerts
A
show all –> compliance –> data loss prevention –> Alerts
3
Q
Required licenses for ENDPOINT DLP
A
M365 E5, A5, Protection and Governance
4
Q
To edit ENDPOINT DLP settings in Purview
A
compliance –> data loss prevention –
> endpoint DLP settings (RESTRICT APPS AND GROUPS, EVIDENCE COLLECTION)
5
Q
To implements DLP for ENDPOINTS
A
Show all –> compliance –> settings –> device onboarding –> “Turn on device onboarding” and download the onboarding package
6
Q
Custom DLP Policies
A
Will need to have a rule with a condition that contains a certain sensitive info type
7
Q
To create a DLP policy in Purview
A
show all –> compliance –> Data loss prevention –
> Policies
8
Q
Data Loss Prevention DLP
A
Prevents data leakage from occurring, monitors and protects sensitive info, identify sensitive info
9
Q
To create Sensitivity Labels in Purview
A
show all –> compliance –> Information protection –> sensitivity labels (must publish)
10
Q
Retention labels
A
must be published to be accessible, adaptive or static, can be auto applied or applied manually
11
Q
Retention Policy
A
Gets rid of certain things at a certain time, info that can only be retained for so long
12
Q
To create Retention labels in Purview
A
show all –> compliance –> data lifecycle management –>labels
13
Q
To create new Sensitive Info types in Purview
A
show all –> compliance –> data classifications –> classifiers
14
Q
Microsoft Purview license requirements
A
M365: E5, A5, G5
Office 365: E5, A5, G5
15
Q
Purview Sensitivity Labels
A
identify and label sensitive information, applied to documents and emails, available to end users
16
Q
Defender for Cloud Apps: App Discovery Policy
A
App discovery policies enable you to set alerts that notify you when new apps are detected within your organization.
17
Q
Defender for Cloud Apps: Session Policy
A
Session policies provide you with real-time monitoring and control over user activity in your cloud apps`
18
Q
Defender for Cloud Apps: Access Policy
A
Access policies provide you with real-time monitoring and control over user logins to your cloud apps
19
Q
Defender for Cloud Apps: File Policy
A
enable you to scan your cloud apps for specified files or file types (shared, shared with external domains), data (proprietary information, personal data, credit card information, and other types of data) and apply governance actions to the files (governance actions are cloud-app specific)
20
Q
Defender for Cloud Apps: Malware Detection Policy
A
enable you to identify malicious files in your cloud storage and automatically approve or revoke it. This is a built-in policy that comes with Defender for Cloud Apps and can’t be created
21
Q
Defender for Cloud Apps: OAuth Policy
A
enable you to investigate which permissions each OAuth app requested and automatically approve or revoke it. (built in)
22
Q
Defender for Cloud Apps: Anomaly Detection Policy
A
enable you to look for unusual activities on your cloud. Detection is based on the risk factors you set to alert you when something happens that is different from the baseline of your organization or from the user’s regular activity
23
Q
Defender for Cloud Apps: Activity Policy
A
Activity policies allow you to enforce a wide range of automated processes using the app provider’s APIs. These policies enable you to monitor specific activities carried out by various users, or follow unexpectedly high rates of a certain type of activity.
24
Q
To configure a Defender for Cloud Apps policy
A
show all –>security –> cloud apps –> Policies (can either create your own or use pre-built)
25
Defender for Cloud apps features
identify cyber threats across Microsoft and 3rd party cloud services, detects unusual behavior across cloud apps, manage compliance of cloud apps, supports Firewall devices, policies to define user behavior in the cloud
26
Security --> Settings --> Endpoints
shows alerts, what kind of attack, where attack originated, what machines were affected
27
Defender for Endpoint settings include
licenses, email notifications, Roles, permissions, device groups
28
To access Defender for Endpoint settings
show all --> security --> settings -->Endpoints
29
To onboard defender for Endpoint onto the user machines
settings --> onboarding --> download onboarding package (not for large scale deployments)
30
To purchase Defender licensing
Billing --> purchase services --> "Defender"
31
Defender for Endpoint Features:
endpoint behavioral sensors, cloud security analytics, threat intelligence, threat and vulnerability management, attack surface reduction, next-gen protection, automated investigation, Secure score, threat experts
32
To show blocked users
Microsoft Defender --> Review
33
To use m365 attack simulation
Show all --> Security --> attack sim training --> simulations --> Launch
34
Threat tracker
only shows threat information
35
To show malware, phishing, blocked email attempts, linked URLs, IP Addresses
Go to show all ---> security --> Explorer
36
Dynamic delivery
sends email but shows that the attachment cannot be opened yet
37
Safe Attachments policy
attachment is opened in a "detonation chamber", +create to make your own, can monitor, block, or dynamically deliver
38
Anti Malware policy
auto-purge feature, common attachments feature, custom notifications, quarantine policy
39
Anti Spam policies
inbound, outbound, connection filter
40
Anti Phishing policies
can be applied to specific groups
41
To implement Defender policies
show all --> Security --> Policies and Rules --> +create to create a custom policy
42
Defender for Office 365 policies include
Safe attachments, safe links, support for sharepoint, OneDrive and Teams, anti-phishing
43
Defender for Office 365
Protects against various threats, originally was just for email
44
To access Microsoft Defender Threat Intelligence
show all --> security --> threat intelligence
45
To view Microsoft Defender reports
Show all --> Security --> Reports
46
To access Defender incidents and alerts
Show all --> Security -->Incidents and Alerts
47
Defender Secure Score
gives a score based on how secure your environment is , will provide step by step guidance on how to implement security improvements
48
To access your Microsoft Defender Secure Score
Show All-->Security-->Secure Score
49
To access Microsoft Defender from M365
Show All -->Security
50
Conditional Access Policies
at their simplest are if-then statements; if a user wants to access a resource, then they must complete an action. For example: If a user wants to access an application or service like Microsoft 365, then they must perform multifactor authentication to gain access.
51
To implement conditional access
Security --> Conditional access
52
Common Signals
Identities, endpoints, applications, data, infrastructure, network
53
Signals
data points used to assess and manage security risks, especially in relation to user sign-in behavior and potential threats
54
Sign in Risk Policy
Shows sign-in risk settings
55
View identity protection in Entra ID
Security-->Protect-->Identity Protection
56
Required Roles for Identity Protection
Security Admin, Security Operator, Security Reader, Global Reader, Global Admin
57
Risky Users
Users who have one or more risky sign ins
58
Identity Protection
helps organizations detect, investigate, and remediate identity based risk
59
To resolve authentication issues in Entra ID
Security --> Authentication Methods -->Activity
60
Implement multi-user MFA
Security --> Conditional Access --> Create new policy "under 'grant' select MFA
61
Where to manage authentication methods and Self service password resets
Security --> Authentication methods
62
Per user MFA options
skip MFA for certain IP ranges, change verification options, remember MFA on certain devices
63
Turn on per user MFA in Entra ID
Users --> Per user MFA "Click enforce to make it mandatory"
64
Multifactor Authentication is made up of
Something you are, Something you have, Something you know
65
Lockout threshold
how many times you can enter the password wrong before you are logged out
66
To enable password protection in Entra ID
Security --> Manage -->Authentication Methods --> password protection
67
To implement self service password reset
Entra ID --> password reset
68
To enable password protection policies
show all --> security --> Policies
69
Local Domain authentication methods
Smart card, Windows 'Hello', Dynamic lock, GPO Password Policies
70
How to troubleshoot your Sync
Entra ID --> Entra Connect --> Status --> Entra Connect Health
71
Scoping Filters
Allow you to select a specific group / OU to sync over
72
Provision on Demand
Lets you sync a single user
73
Entra ID "Cloud" Sync
for smaller environments, lightweight, Entra Connect-->Cloud Sync,
Need server 2016 or later
74
Where to monitor the Entra Connect Sync
Entra ID Connect --> Health and Analytics or you can install an AD DS agent to track health on prem
75
Entra ID Connect: Enable SSO
need a domain admin account will enable sso
76
Entra ID Connect: Directory Extensions
allows Entra ID to query the directory of on prem AD DS
77
Entra ID Connect: Entra ID Attributes
attributes from apps are exported to Entra ID
78
Entra ID Connect: Directory Extension Attribute Sync
Allows on prem attributes to sync to the cloud
79
Entra ID Connect: Password Writeback
changing the password in Entra ID will sync to on prem domain
80
Entra ID Connect: App and Attribute Filtering
cloud based apps will sync down to local domain
81
Forest Account
created account with the permissions needed for sync, must be enterprise admin
82
Downloading Entra Connect
Microsoft Entra Connect in Entra ID menu
83
IDFix tool
run against the domain, cannot run on the server, clicking query on the tool will display any errors in the domain
84
Usernames in Entra ID
Cannot have a space, sync will fail
85
Federated
need AD FS services, need proxy servers in DMZ, more hardware
86
Entra ID Passthrough authentication
password validation goes through on premise software agent, password validation happens on prem (new)
87
Entra ID Password Hash Sync
simplest, same username in cloud and onsite, allows access to premium features, sync runs every 2 minutes
88
Source Anchor
"immutable ID" typically ms-ds-consistencyguid is used. uniquely identifies object as the same object on prem and in Entra ID
89
Staging Mode
makes the server active for import and synchronization, but it doesn't run any exports. A server in staging mode isn't running password sync or password writeback, even if you selected these features during installation.
90
Scope and Object Filtering
remove known buckets of objects that don't need to be synced ex. unused service accounts, servers
91
Why use Federated Authentication?
large enterprises, user accounts are managed on prem, implements with 3rd party authentication
92
Pass-Through Authentication (PTA)
Entra ID has AD DS perform authentication (on prem AD), IF AD goes down you cannot authenticate
93
Password Hash Synchronization (PHS)
Entra ID performs authentication
94
Federated Authentication
Entra ID redirects the client computer trying to be authenticated to another identity provider
95
Managed Authentication
MOST COMMON, Entra ID handles the authorization process by using locally stored hashed versions of passwords or send credentials on premise
96
Hybrid Identity Sync
most common choice, allows you to manage identities in ADDS (on prem) and all updates are synced to Entra ID (Cloud)
97
Implement PIM in Entra ID
All services --> PIM -->Microsoft Entra Roles
98
PIM Terminology: Activated
user that is activated
99
PIM Terminology: Assigned
user that has active role assignment
100
PIM Terminology: Activate
process of performing one more actions to use a role
101
PIM Terminology: Active
doesn't require user to perform any actions to use role
102
PIM Terminology: Eligible
user must perform one or more actions to use the role
103
How to access PIM
Identity governance > Privileged Identity Management > My roles
104
Roles Required to manage PIM
Privileged Role Admin or Global Admin
105
PIM Key Features
time-bound access, approval to activate the role, MFA, Access Review, Audit history
106
Privileged Identity Management (PIM)
gives the ability to control, manage, monitor access to resources in your org (need Entra ID P2 or Entra ID governance)
107
Administrative Units
a Microsoft Entra resource that can be a container for other Microsoft Entra resources. An administrative unit can contain only users, groups, or devices (requires Azure AD premium 1)
108
To show/create roles in Microsoft Defender
--->Permissions
109
To get to Microsoft Defender
Show All--> Security
110
Add a Role Assignment to a user in M365
Roles--> Role Assignments
111
Add a Role Assignment to a user in Entra ID
Click on the role --> Assignments--> Add Assignments
112
Manage roles in Entra ID
Roles-->Administrators
113
Principle of Least Privilege
giving out the least amount of rights needed for someone to do their job
114
To manage license in Entra ID
manage --> Licenses
115
To buy more licenses in M365
Marketplace -->
116
To manage licenses in M365
Billing --> Licenses
117
Microsoft 365 F3
Less Features// Cheapest
Web and mobile versions of Microsoft 365 apps
Standard security capabilities
Centralized hub for collaboration and productivity
Custom apps to automate tasks and processes
Microsoft 365 Copilot, available as an add-on2
118
Microsoft 365 E5
NO TEAMS!
Everything in Microsoft 365 E3, plus:
Advanced security and compliance capabilities
Scalable business analytics with Power BI
Microsoft 365 Copilot, available as an add-on
119
Microsoft 365 E3
NO TEAMS!
Microsoft 365 apps for desktop and mobile
Windows for Enterprise
1 TB of cloud storage
Core security and identity management capabilities
Microsoft 365 Copilot, available as an add-on2
120
Microsoft 365 Enterprise Plans
designed for larger organizations with advanced security, compliance, and customization needs
121
Microsoft 365 Standard Plans
Add desktop Apps + more features
122
Microsoft 365 Basic Plans
ideal for smaller businesses requiring core productivity tools and cloud storage
123
Creating a group in Entra ID
Groups --> All groups --> New Group, only two options: security and M365// will no automatically create a team when group is made
124
Dynamic Group (Entra ID)
specify a query to automatically add/remove users from a group
125
Assigned Group
cannot be dynamically assigned
126
Security Group*
Used for device management, only group where you can add Devices, no email associated
127
Mail-Enabled Group
has access to OneDrive and Sharepoint, gets an email address
128
Distribution Group
mostly for email purposes, gets an email address
129
M365 Group
can do almost anything, team collab, gets email address and shared calendar
130
To create a group in M365
Teams and Groups-->Active-->Add
131
Where to see contacts in Outlook?
Directory-->contacts
132
To add contacts in M365
users-->contacts-->add
133
Contacts
people outside of the organization that you'd like to keep in touch with
134
To add guest user in M365
Users-->Guests-->Add a guest-->(Will direct you to Entra ID)
135
To add guest user in Entra ID
users-->New-->Invite External Users
136
Guest User
not part of the org but you want to invite them temporarily ex:consultant, more monitored than regular user, uses their own email address
137
To create users in M365
Users-->Active Users--> Add User
138
To create users in Entra ID
Manage-->users-->Create New+
139
To monitor adoption score
M365 Admin Center --> Reports --> Adoption Score
140
To turn on service health notifications
M365 Admin Center-->Health-->Service Health-->Customize-->Email
141
To check service health status (of Microsoft cloud services)
M365 Admin Center -->Health-->Service Health
142
In Org Settings --> Org Profile
Customize organizational information, customize themes
143
In Org Settings--> Security &Privacy
Privileged Access, Microsoft Support Password resets
144
In Org Settings--> Services
shows settings for different apps/services
145
To configure organization settings
M365 Admin Center --> Org Settings
146
To add a domain (in Entra)
Microsoft Entra ID --> Custom Domain -- > + add
147
To add a domain
M365 Admin Center -- > Domains --> Add Domain -->Verify the Domain
148
To create a new Tenant
Go to Microsoft Entra ID --> manage tenants --> create
149
Microsoft 365 Tenant
a dedicated instance of the services of Microsoft 365 and your organization data stored within a specific default location, such as Europe or North America. Also includes a Microsoft Entra tenant
150
Microsoft Entra Connect
a Microsoft application that facilitates hybrid identity solutions by connecting on-premises Active Directory with Microsoft Entra ID
151
Security Reader role group
access to download compliance reports from the Security & Compliance admin center.
152
Entra ID Seamless Single Sign-On (SSO)
This enables seamless integration between your on-premises AD and Entra ID, providing a seamless user experience
153
Conditional Access Policy
Entra ID feature allows you to define access policies based on various conditions, including user location.
154
The most frequent schedule you can set for delivering DLP incident reports in Microsoft 365
hourly.
155
Message center in the Microsoft 365 admin center
view a list of the features that were recently updated in the tenant.
156
number of days that Microsoft 365 retains PST file before deleting them automatically?
30 day
157
Microsoft 365 admin center – Products blade:
provides an overview of the Microsoft 365 services your organization has subscribed to, not user-specific license assignments
158
Threat management policy
typically involve broader security configurations, such as managing anti-malware or anti-phishing settings at a higher level
159
Label policy
policies in Microsoft 365 are used to classify and protect sensitive information by applying sensitivity labels to documents and emails
160
spam filter policy
are specifically designed to detect and block phishing emails, spam, and other malicious content by leveraging Microsoft’s advanced threat protection capabilities
161
A tenant user has submitted a fraud alert for his account, how long is the account automatically blocked?
90 Days
162
Set-EmailAddressPolicy
Powershell cmdlet making sure that the primary email address of all new mailboxes uses the new domain
163
Start-ADSyncSyncCycle
command to make sure that the new user accounts synchronize to Azure AD in the shortest time required.
164
Entra ID Connect filtering settings
Filtering is where you select the OU‘s to be synchronized with AAD.
165
MX Records
1.) Add Custom Domain
2.) Move Mailboxes
3.) Update DNS Records (MX, SPF) to point to EXO
166
Entra ID Licenses Blade
The license blade does not give you information about the enabled services for induvial users, only the license and list of services within the license that can be enabled for the users
167
Compliance Administrator
has broad access to compliance-related settings, including retention policies
168
eDiscovery Manager
responsible for managing eDiscovery cases (searching and exporting content for legal investigations)
169
Security Administrator
focuses on security-related configurations, such as threat management and security alerts
170
Records Management role group
grants users the ability to create, manage, and publish retention labels and policies,
171
IDFIX.exe
fix the issues with the attributes of the users which would show up in the sync errors when syncing on prem ad to cloud
172
Security & Compliance data loss prevention (DLP) policies
focus on preventing sensitive data from leaving the organization.
173
Security & Compliance supervision policies
Supervision policies are used to monitor and archive communications, but they don’t directly block user sign-ins
174
microsoft Azure Active Directory (Azure AD) Identity Protection policies
designed to detect risky sign-ins and automatically take action to protect user accounts. The error message “Your sign-in was blocked…we’ve detected something unusual…” is a classic indicator of an Identity Protection policy being triggered. These policies can be configured to block sign-ins or require additional verification steps (like MFA) when a risky sign-in is detected.
175
176
show all --> compliance --> data loss prevention --> Alerts
To see DLP Alerts
177
M365 E5, A5, Protection and Governance
Required licenses for ENDPOINT DLP
178
compliance --> data loss prevention --
> endpoint DLP settings (RESTRICT APPS AND GROUPS, EVIDENCE COLLECTION)
To edit ENDPOINT DLP settings in Purview
179
Show all --> compliance --> settings --> device onboarding --> "Turn on device onboarding" and download the onboarding package
To implements DLP for ENDPOINTS
180
Will need to have a rule with a condition that contains a certain sensitive info type
Custom DLP Policies
181
show all --> compliance --> Data loss prevention --
> Policies
To create a DLP policy in Purview
182
Prevents data leakage from occurring, monitors and protects sensitive info, identify sensitive info
Data Loss Prevention DLP
183
show all --> compliance --> Information protection --> sensitivity labels (must publish)
To create Sensitivity Labels in Purview
184
must be published to be accessible, adaptive or static, can be auto applied or applied manually
Retention labels
185
Gets rid of certain things at a certain time, info that can only be retained for so long
Retention Policy
186
show all --> compliance --> data lifecycle management -->labels
To create Retention labels in Purview
187
show all --> compliance --> data classifications --> classifiers
To create new Sensitive Info types in Purview
188
M365: E5, A5, G5
Office 365: E5, A5, G5
Microsoft Purview license requirements
189
identify and label sensitive information, applied to documents and emails, available to end users
Purview Sensitivity Labels
190
App discovery policies enable you to set alerts that notify you when new apps are detected within your organization.
Defender for Cloud Apps: App Discovery Policy
191
Session policies provide you with real-time monitoring and control over user activity in your cloud apps`
Defender for Cloud Apps: Session Policy
192
Access policies provide you with real-time monitoring and control over user logins to your cloud apps
Defender for Cloud Apps: Access Policy
193
enable you to scan your cloud apps for specified files or file types (shared, shared with external domains), data (proprietary information, personal data, credit card information, and other types of data) and apply governance actions to the files (governance actions are cloud-app specific)
Defender for Cloud Apps: File Policy
194
enable you to identify malicious files in your cloud storage and automatically approve or revoke it. This is a built-in policy that comes with Defender for Cloud Apps and can't be created
Defender for Cloud Apps: Malware Detection Policy
195
enable you to investigate which permissions each OAuth app requested and automatically approve or revoke it. (built in)
Defender for Cloud Apps: OAuth Policy
196
enable you to look for unusual activities on your cloud. Detection is based on the risk factors you set to alert you when something happens that is different from the baseline of your organization or from the user's regular activity
Defender for Cloud Apps: Anomaly Detection Policy
197
Activity policies allow you to enforce a wide range of automated processes using the app provider's APIs. These policies enable you to monitor specific activities carried out by various users, or follow unexpectedly high rates of a certain type of activity.
Defender for Cloud Apps: Activity Policy
198
show all -->security --> cloud apps --> Policies (can either create your own or use pre-built)
To configure a Defender for Cloud Apps policy
199
identify cyber threats across Microsoft and 3rd party cloud services, detects unusual behavior across cloud apps, manage compliance of cloud apps, supports Firewall devices, policies to define user behavior in the cloud
Defender for Cloud apps features
200
shows alerts, what kind of attack, where attack originated, what machines were affected
Security --> Settings --> Endpoints
201
licenses, email notifications, Roles, permissions, device groups
Defender for Endpoint settings include
202
show all --> security --> settings -->Endpoints
To access Defender for Endpoint settings
203
settings --> onboarding --> download onboarding package (not for large scale deployments)
To onboard defender for Endpoint onto the user machines
204
Billing --> purchase services --> "Defender"
To purchase Defender licensing
205
endpoint behavioral sensors, cloud security analytics, threat intelligence, threat and vulnerability management, attack surface reduction, next-gen protection, automated investigation, Secure score, threat experts
Defender for Endpoint Features:
206
Microsoft Defender --> Review
To show blocked users
207
Show all --> Security --> attack sim training --> simulations --> Launch
To use m365 attack simulation
208
only shows threat information
Threat tracker
209
Go to show all ---> security --> Explorer
To show malware, phishing, blocked email attempts, linked URLs, IP Addresses
210
sends email but shows that the attachment cannot be opened yet
Dynamic delivery
211
attachment is opened in a "detonation chamber", +create to make your own, can monitor, block, or dynamically deliver
Safe Attachments policy
212
auto-purge feature, common attachments feature, custom notifications, quarantine policy
Anti Malware policy
213
inbound, outbound, connection filter
Anti Spam policies
214
can be applied to specific groups
Anti Phishing policies
215
show all --> Security --> Policies and Rules --> +create to create a custom policy
To implement Defender policies
216
Safe attachments, safe links, support for sharepoint, OneDrive and Teams, anti-phishing
Defender for Office 365 policies include
217
Protects against various threats, originally was just for email
Defender for Office 365
218
show all --> security --> threat intelligence
To access Microsoft Defender Threat Intelligence
219
Show all --> Security --> Reports
To view Microsoft Defender reports
220
Show all --> Security -->Incidents and Alerts
To access Defender incidents and alerts
221
gives a score based on how secure your environment is , will provide step by step guidance on how to implement security improvements
Defender Secure Score
222
Show All-->Security-->Secure Score
To access your Microsoft Defender Secure Score
223
Show All -->Security
To access Microsoft Defender from M365
224
at their simplest are if-then statements; if a user wants to access a resource, then they must complete an action. For example: If a user wants to access an application or service like Microsoft 365, then they must perform multifactor authentication to gain access.
Conditional Access Policies
225
Security --> Conditional access
To implement conditional access
226
Identities, endpoints, applications, data, infrastructure, network
Common Signals
227
data points used to assess and manage security risks, especially in relation to user sign-in behavior and potential threats
Signals
228
Shows sign-in risk settings
Sign in Risk Policy
229
Security-->Protect-->Identity Protection
View identity protection in Entra ID
230
Security Admin, Security Operator, Security Reader, Global Reader, Global Admin
Required Roles for Identity Protection
231
Users who have one or more risky sign ins
Risky Users
232
helps organizations detect, investigate, and remediate identity based risk
Identity Protection
233
Security --> Authentication Methods -->Activity
To resolve authentication issues in Entra ID
234
Security --> Conditional Access --> Create new policy "under 'grant' select MFA
Implement multi-user MFA
235
Security --> Authentication methods
Where to manage authentication methods and Self service password resets
236
skip MFA for certain IP ranges, change verification options, remember MFA on certain devices
Per user MFA options
237
Users --> Per user MFA "Click enforce to make it mandatory"
Turn on per user MFA in Entra ID
238
Something you are, Something you have, Something you know
Multifactor Authentication is made up of
239
how many times you can enter the password wrong before you are logged out
Lockout threshold
240
Security --> Manage -->Authentication Methods --> password protection
To enable password protection in Entra ID
241
Entra ID --> password reset
To implement self service password reset
242
show all --> security --> Policies
To enable password protection policies
243
Smart card, Windows 'Hello', Dynamic lock, GPO Password Policies
Local Domain authentication methods
244
Entra ID --> Entra Connect --> Status --> Entra Connect Health
How to troubleshoot your Sync
245
Allow you to select a specific group / OU to sync over
Scoping Filters
246
Lets you sync a single user
Provision on Demand
247
for smaller environments, lightweight, Entra Connect-->Cloud Sync,
Need server 2016 or later
Entra ID "Cloud" Sync
248
Entra ID Connect --> Health and Analytics or you can install an AD DS agent to track health on prem
Where to monitor the Entra Connect Sync
249
need a domain admin account will enable sso
Entra ID Connect: Enable SSO
250
allows Entra ID to query the directory of on prem AD DS
Entra ID Connect: Directory Extensions
251
attributes from apps are exported to Entra ID
Entra ID Connect: Entra ID Attributes
252
Allows on prem attributes to sync to the cloud
Entra ID Connect: Directory Extension Attribute Sync
253
changing the password in Entra ID will sync to on prem domain
Entra ID Connect: Password Writeback
254
cloud based apps will sync down to local domain
Entra ID Connect: App and Attribute Filtering
255
created account with the permissions needed for sync, must be enterprise admin
Forest Account
256
Microsoft Entra Connect in Entra ID menu
Downloading Entra Connect
257
run against the domain, cannot run on the server, clicking query on the tool will display any errors in the domain
IDFix tool
258
Cannot have a space, sync will fail
Usernames in Entra ID
259
need AD FS services, need proxy servers in DMZ, more hardware
Federated
260
password validation goes through on premise software agent, password validation happens on prem (new)
Entra ID Passthrough authentication
261
simplest, same username in cloud and onsite, allows access to premium features, sync runs every 2 minutes
Entra ID Password Hash Sync
262
"immutable ID" typically ms-ds-consistencyguid is used. uniquely identifies object as the same object on prem and in Entra ID
Source Anchor
263
makes the server active for import and synchronization, but it doesn't run any exports. A server in staging mode isn't running password sync or password writeback, even if you selected these features during installation.
Staging Mode
264
remove known buckets of objects that don't need to be synced ex. unused service accounts, servers
Scope and Object Filtering
265
large enterprises, user accounts are managed on prem, implements with 3rd party authentication
Why use Federated Authentication?
266
Entra ID has AD DS perform authentication (on prem AD), IF AD goes down you cannot authenticate
Pass-Through Authentication (PTA)
267
Entra ID performs authentication
Password Hash Synchronization (PHS)
268
Entra ID redirects the client computer trying to be authenticated to another identity provider
Federated Authentication
269
MOST COMMON, Entra ID handles the authorization process by using locally stored hashed versions of passwords or send credentials on premise
Managed Authentication
270
most common choice, allows you to manage identities in ADDS (on prem) and all updates are synced to Entra ID (Cloud)
Hybrid Identity Sync
271
All services --> PIM -->Microsoft Entra Roles
Implement PIM in Entra ID
272
user that is activated
PIM Terminology: Activated
273
user that has active role assignment
PIM Terminology: Assigned
274
process of performing one more actions to use a role
PIM Terminology: Activate
275
doesn't require user to perform any actions to use role
PIM Terminology: Active
276
user must perform one or more actions to use the role
PIM Terminology: Eligible
277
Identity governance > Privileged Identity Management > My roles
How to access PIM
278
Privileged Role Admin or Global Admin
Roles Required to manage PIM
279
time-bound access, approval to activate the role, MFA, Access Review, Audit history
PIM Key Features
280
gives the ability to control, manage, monitor access to resources in your org (need Entra ID P2 or Entra ID governance)
Privileged Identity Management (PIM)
281
a Microsoft Entra resource that can be a container for other Microsoft Entra resources. An administrative unit can contain only users, groups, or devices (requires Azure AD premium 1)
Administrative Units
282
--->Permissions
To show/create roles in Microsoft Defender
283
Show All--> Security
To get to Microsoft Defender
284
Roles--> Role Assignments
Add a Role Assignment to a user in M365
285
Click on the role --> Assignments--> Add Assignments
Add a Role Assignment to a user in Entra ID
286
Roles-->Administrators
Manage roles in Entra ID
287
giving out the least amount of rights needed for someone to do their job
Principle of Least Privilege
288
manage --> Licenses
To manage license in Entra ID
289
Marketplace -->
To buy more licenses in M365
290
Billing --> Licenses
To manage licenses in M365
291
Less Features// Cheapest
Web and mobile versions of Microsoft 365 apps
Standard security capabilities
Centralized hub for collaboration and productivity
Custom apps to automate tasks and processes
Microsoft 365 Copilot, available as an add-on2
Microsoft 365 F3
292
NO TEAMS!
Everything in Microsoft 365 E3, plus:
Advanced security and compliance capabilities
Scalable business analytics with Power BI
Microsoft 365 Copilot, available as an add-on
Microsoft 365 E5
293
NO TEAMS!
Microsoft 365 apps for desktop and mobile
Windows for Enterprise
1 TB of cloud storage
Core security and identity management capabilities
Microsoft 365 Copilot, available as an add-on2
Microsoft 365 E3
294
designed for larger organizations with advanced security, compliance, and customization needs
Microsoft 365 Enterprise Plans
295
Add desktop Apps + more features
Microsoft 365 Standard Plans
296
ideal for smaller businesses requiring core productivity tools and cloud storage
Microsoft 365 Basic Plans
297
Groups --> All groups --> New Group, only two options: security and M365// will no automatically create a team when group is made
Creating a group in Entra ID
298
specify a query to automatically add/remove users from a group
Dynamic Group (Entra ID)
299
cannot be dynamically assigned
Assigned Group
300
Used for device management, only group where you can add Devices, no email associated
Security Group*
301
has access to OneDrive and Sharepoint, gets an email address
Mail-Enabled Group
302
mostly for email purposes, gets an email address
Distribution Group
303
can do almost anything, team collab, gets email address and shared calendar
M365 Group
304
Teams and Groups-->Active-->Add
To create a group in M365
305
Directory-->contacts
Where to see contacts in Outlook?
306
users-->contacts-->add
To add contacts in M365
307
people outside of the organization that you'd like to keep in touch with
Contacts
308
Users-->Guests-->Add a guest-->(Will direct you to Entra ID)
To add guest user in M365
309
users-->New-->Invite External Users
To add guest user in Entra ID
310
not part of the org but you want to invite them temporarily ex:consultant, more monitored than regular user, uses their own email address
Guest User
311
Users-->Active Users--> Add User
To create users in M365
312
Manage-->users-->Create New+
To create users in Entra ID
313
M365 Admin Center --> Reports --> Adoption Score
To monitor adoption score
314
M365 Admin Center-->Health-->Service Health-->Customize-->Email
To turn on service health notifications
315
M365 Admin Center -->Health-->Service Health
To check service health status (of Microsoft cloud services)
316
Customize organizational information, customize themes
In Org Settings --> Org Profile
317
Privileged Access, Microsoft Support Password resets
In Org Settings--> Security &Privacy
318
shows settings for different apps/services
In Org Settings--> Services
319
M365 Admin Center --> Org Settings
To configure organization settings
320
Microsoft Entra ID --> Custom Domain -- > + add
To add a domain (in Entra)
321
M365 Admin Center -- > Domains --> Add Domain -->Verify the Domain
To add a domain
322
Go to Microsoft Entra ID --> manage tenants --> create
To create a new Tenant
323
a dedicated instance of the services of Microsoft 365 and your organization data stored within a specific default location, such as Europe or North America. Also includes a Microsoft Entra tenant
Microsoft 365 Tenant
324
a Microsoft application that facilitates hybrid identity solutions by connecting on-premises Active Directory with Microsoft Entra ID
Microsoft Entra Connect
325
access to download compliance reports from the Security & Compliance admin center.
Security Reader role group
326
This enables seamless integration between your on-premises AD and Entra ID, providing a seamless user experience
Entra ID Seamless Single Sign-On (SSO)
327
Entra ID feature allows you to define access policies based on various conditions, including user location.
Conditional Access Policy
328
hourly.
The most frequent schedule you can set for delivering DLP incident reports in Microsoft 365
329
view a list of the features that were recently updated in the tenant.
Message center in the Microsoft 365 admin center
330
30 day
number of days that Microsoft 365 retains PST file before deleting them automatically?
331
provides an overview of the Microsoft 365 services your organization has subscribed to, not user-specific license assignments
Microsoft 365 admin center – Products blade:
332
typically involve broader security configurations, such as managing anti-malware or anti-phishing settings at a higher level
Threat management policy
333
policies in Microsoft 365 are used to classify and protect sensitive information by applying sensitivity labels to documents and emails
Label policy
334
are specifically designed to detect and block phishing emails, spam, and other malicious content by leveraging Microsoft’s advanced threat protection capabilities
spam filter policy
335
90 Days
A tenant user has submitted a fraud alert for his account, how long is the account automatically blocked?
336
Powershell cmdlet making sure that the primary email address of all new mailboxes uses the new domain
Set-EmailAddressPolicy
337
command to make sure that the new user accounts synchronize to Azure AD in the shortest time required.
Start-ADSyncSyncCycle
338
Filtering is where you select the OU‘s to be synchronized with AAD.
Entra ID Connect filtering settings
339
1.) Add Custom Domain
2.) Move Mailboxes
3.) Update DNS Records (MX, SPF) to point to EXO
MX Records
340
The license blade does not give you information about the enabled services for induvial users, only the license and list of services within the license that can be enabled for the users
Entra ID Licenses Blade
341
has broad access to compliance-related settings, including retention policies
Compliance Administrator
342
responsible for managing eDiscovery cases (searching and exporting content for legal investigations)
eDiscovery Manager
343
focuses on security-related configurations, such as threat management and security alerts
Security Administrator
344
grants users the ability to create, manage, and publish retention labels and policies,
Records Management role group
345
fix the issues with the attributes of the users which would show up in the sync errors when syncing on prem ad to cloud
IDFIX.exe
346
focus on preventing sensitive data from leaving the organization.
Security & Compliance data loss prevention (DLP) policies
347
Supervision policies are used to monitor and archive communications, but they don’t directly block user sign-ins
Security & Compliance supervision policies
348
designed to detect risky sign-ins and automatically take action to protect user accounts. The error message “Your sign-in was blocked…we’ve detected something unusual…” is a classic indicator of an Identity Protection policy being triggered. These policies can be configured to block sign-ins or require additional verification steps (like MFA) when a risky sign-in is detected.
microsoft Azure Active Directory (Azure AD) Identity Protection policies
