MS-102 Managing Identity and Access Flashcards
(34 cards)
Passwordless authentication
creates a complete experience for all employees, so they no longer need passwords to sign in to the network. Instead, Microsoft Entra ID lets them sign-in with biometrics or a tap using:
Windows Hello for Business
the Microsoft Authenticator app
a compatible FIDO2 security key
Microsoft Entra verifiable credentials
Verifiable credentials let organizations confirm information—like their education or the professional certifications someone provides—without collecting and storing their personal data.
default password expiration policy in Microsoft 365
sets users’ passwords to never expire
To change the default password expiration policy,
Sign in to the Microsoft 365 admin center and, if necessary, select Show all in the navigation pane.
In the navigation pane, select Settings and then select Org settings.
On the Org settings page, the Services tab is displayed by default. Select the Security & privacy tab.
In the Security & privacy tab, select Password expiration policy.
To access Microsoft Entra Password Protection, you must be assigned one of the following roles
Global Administrator, Security Administrator, or Privileged Role Administrator.
To enable the custom banned password list and add entries to it,
In the Microsoft 365 admin center, in the navigation pane under the Admin centers group, select Identity.
In the Microsoft Entra admin center, select Protection in the navigation pane to expand the group, and then select Authentication methods.
On the Authentication methods | Policies page, in the middle pane under the Manage section, select Password protection.
On the Authentication methods | Password protection page, set the Enforce custom list option to Yes.
Add strings to the Custom banned password list, one string per line. The following considerations and limitations apply to the custom banned password list:
complete the following steps to create a Conditional Access policy
In the Microsoft Intune admin center, select Endpoint security in the left-hand navigation pane.
On the Endpoint security | Overview page, under the Manage section in the middle pane, select Conditional Access.
On the Conditional Access | Policies page, select +New policy on the menu bar.
Port 80
Enables outbound HTTP traffic for security validation such as TLS/SSL certificate revocation lists.
Port 443
Enables user authentication against Microsoft Entra ID.
Security Defaults
provides a basic level of security by turning on MFA, blocks legacy authentication protocols, and requires users to register for Microsoft Entra MFA.
enable or disable security defaults from the Properties pane for Microsoft Entra ID
In the Microsoft Entra admin center, in the left-hand navigation pane, select Overview.
On the Overview page for your organization’s tenant, the system displays the Overview tab by default. Select the Properties tab.
Under the Security Defaults section, select the Manage security defaults link.
enable multifactor authentication on a per-user basis in the Microsoft 365 admin center
In the Microsoft 365 admin center, in the left-hand navigation pane, select Settings and then select Org settings.
On the Org settings page, under the Services tab (which is displayed by default) select Multifactor authentication.
In the Multifactor authentication pane that appears, select Configure multifactor authentication.
On the multifactor authentication page, two tabs are available - one for users and one for service settings.
On the users tab, you can enable (or disable) multifactor authentication for one or more users. You can
five passwordless authentication option
Windows Hello for Business
Platform Credential for macOS
Platform single sign-on (PSSO) for macOS with smart card authentication
Microsoft Authenticator
Passkeys (FIDO2)
Certificate-based authentication
Password writeback
. Microsoft Entra Premium includes the ability to write back passwords. This feature enables organizations to implement self-service password reset for synchronized identities and federated identities
Smart Lockout
locks out bad actors who are trying to guess users’ passwords or use brute-force methods to gain access. It can recognize sign-ins coming from valid users and treat them differently than ones of attackers and other unknown source
To check or modify the Smart Lockout values for an organization
Sign in to the Microsoft Entra admin center and navigate to Protection > Authentication methods > Password protection.
Set the Lockout threshold, based on how many failed sign-ins the organization allows on an account before its first lockout. The default is 10.
Set the Lockout duration in seconds, to the length in seconds of each lockout. The default is 60 seconds.
Microsoft Defender for Identity
cloud-based security solution. It uses your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.
To view and use Microsoft XDR Defender Security Reports what roles do you need to have
Organization Management
Security Administrator
Security Reader
Global Reader
How Microsoft Secure Score works
You’re given points for the following actions:
Configuring recommended security features
Doing security-related tasks
Addressing the recommended action with a third-party application or software, or an alternate mitigation
recommended action statuses
To address, Planned, Risk Accepted, Resolved through third party and resolver through alternate mitigation
To Address
You recognize the recommended action is necessary and plan to address it at some point in the future. This state also applies to partially completed actions.
Planned
There are concrete plans in place to complete the recommended action.
Risk accepted
Organizations should always balance security with usability. Keep in mind, not every recommendation works for your environment. In those instances, you can choose to accept the risk, or the remaining risk, and not enact the recommended action. This status doesn’t receive any points. You can view this action in history or undo it at any time.
Resolved through third party and Resolved through alternate mitigation.
An internal tool or a third-party application already addressed the recommended action. You gain the points the action is worth, so your score more closely reflects your overall security posture.
