Question bank
Microsoft Certified: Identity and Access Administrator Associate
42 Microsoft Certified: Identity and Access Administrator Associate questions with the correct answer and a written explanation, organised across 4 exam domains.
- 42 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Implement and manage user identities
12 questions in this domain
- Question 1Single Choice
What is the primary goal of identity lifecycle management?
- AAccess granted precisely when needed and revoked immediatelyCorrect answer
- BAll users receive permanent administrative access
- CPasswords remain unchanged for all identities
- DLicenses are assigned without any verification
Why this is the answer
Identity lifecycle management covers onboarding through offboarding and ensures access is granted and revoked at the correct times to prevent ghost accounts.
- Question 2Multiple Select
Which two user attributes are commonly used as the foundation for dynamic groups and ABAC?
- AJob titleCorrect answer
- BDepartment codeCorrect answer
- CHome address
- DPassword hash
Why this is the answer
Job title and department code are common identity attributes used in dynamic membership rules and attribute-based access control.
- Question 3Interactive
An administrator runs the following PowerShell command. What will the command create?
- ADynamic security group based on departmentCorrect answer
- BStatic administrative unit
- CMicrosoft 365 group with shared mailbox
- DConditional Access policy
Why this is the answer
The command creates a dynamic security group using a membership rule that evaluates the department attribute.
- Question 4Single Choice
Which tool is used to synchronize on-premises Active Directory identities with Microsoft Entra ID?
- AEntra ConnectCorrect answer
- BSCIM
- CAzure RBAC
- DApplication Proxy
Why this is the answer
Entra Connect handles synchronization of on-premises Active Directory identities to Microsoft Entra ID for hybrid environments.
- Question 5Multiple Select
Which two statements about B2B guest identities are correct?
- AGuests must have Conditional Access explicitly appliedCorrect answer
- BGuests are invited through B2B collaborationCorrect answer
- CExternal users automatically inherit all tenant policies
- DGuest access is managed through Azure RBAC roles
Why this is the answer
Guest identities are invited via B2B collaboration and require explicit Conditional Access and governance because tenant policies do not automatically apply to them.
- Question 6Interactive
Refer to the following SCIM payload. Which two statements correctly describe it?
- AIt defines a user resource with username and emailCorrect answer
- BIt follows the SCIM 2.0 schemaCorrect answer
- CIt assigns an Azure RBAC role
- DIt creates a Microsoft 365 group
Why this is the answer
The payload is a SCIM 2.0 user representation containing identity attributes such as username and work email.
- Question 7Single Choice
What is the purpose of lifecycle workflows in Microsoft Entra ID?
- AIdentity tasks triggered by joiner, mover, or leaver eventsCorrect answer
- BSynchronization rule enforcement
- CAzure subscription management
- DNetwork security configuration
Why this is the answer
Lifecycle workflows automate identity tasks based on organizational events such as joining, moving, or leaving.
- Question 8Multiple Select
Which of the following statements correctly describe the Joiner-Mover-Leaver process?
- AJoiners receive initial accessCorrect answer
- BMovers receive updated permissions reflecting new rolesCorrect answer
- CLeavers have all access revoked immediatelyCorrect answer
- DLeavers only need their account disabled
Why this is the answer
JML requires giving joiners initial access, updating movers' permissions, and revoking leavers' access to prevent orphaned accounts.
- Question 9Interactive
Consider the following lifecycle workflow definition. What does it automate?
- ADisables a user account when an employee leavesCorrect answer
- BCreates a new user when an employee joins
- CAssigns licenses during a move
- DDeletes all Microsoft 365 groups automatically
Why this is the answer
The workflow is enabled and contains a Leaver task that disables the user account during offboarding.
- Question 10Single Choice
What is the main purpose of access reviews?
- APeriodically validate that users still need assigned permissionsCorrect answer
- BGrant all users access to all resources
- CRemove multi-factor authentication requirements
- DCreate administrative units
Why this is the answer
Access reviews validate existing permissions periodically and help prevent privilege creep during the maintenance phase.
- Question 11Multiple Select
Which two scenarios are examples of orphaned accounts?
- AA former employee's account remains active in a SaaS applicationCorrect answer
- BAn account remains enabled after the user has left the companyCorrect answer
- CA new employee account is provisioned with initial access
- DA mover receives updated permissions for a new role
Why this is the answer
Orphaned accounts are identities that stay active after a user departs, leaving a security vulnerability in connected systems.
- Question 12Interactive
Review the following Microsoft Graph command. What does it configure?
- AAdministrative unit for scoped administrative delegationCorrect answer
- BMicrosoft 365 group for collaboration
- CDynamic group with membership rule
- DGlobal admin role assignment
Why this is the answer
New-MgAdministrativeUnit creates an administrative unit, which delegates scoped admin permissions over a set of users or resources.
Implement authentication and access management
12 questions in this domain
- Question 13Single Choice
Which statement best describes identity lifecycle management in Microsoft Entra ID?
- AIt is the complete journey of an identity from onboarding to offboardingCorrect answer
- BIt only covers password synchronization between systems
- CIt is used exclusively to manage guest users
- DIt is the process of assigning Azure administrator roles
Why this is the answer
Identity lifecycle management covers the full identity journey, including provisioning as users join and deprovisioning as they leave.
- Question 14Multiple Select
Which directory attributes are commonly used for dynamic group rules and automated provisioning?
- AJob titleCorrect answer
- BDepartment codeCorrect answer
- CManagerCorrect answer
- DDevice OS version
Why this is the answer
Job title, department code, and manager are standard user attributes used by dynamic rules, ABAC, and provisioning workflows.
- Question 15Interactive
The rule shown in the code block determines group membership. How will membership be assigned?
- AAll users in the tenant
- BUsers whose department attribute equals SalesCorrect answer
- COnly users manually assigned by an administrator
- DUsers with a job title of Sales Manager
Why this is the answer
The dynamic rule adds any user whose department attribute equals Sales. Membership is not manual and is based on the department attribute.
- Question 16Single Choice
What is the primary purpose of SCIM in Microsoft Entra ID?
- ATo exchange user identity information automatically between identity providers and SaaS applicationsCorrect answer
- BTo replace password-based authentication with certificates
- CTo create an on-premises Active Directory forest
- DTo manage Azure resource permissions
Why this is the answer
SCIM standardizes user identity exchange between Microsoft Entra ID and SaaS apps, enabling automated provisioning and consistency.
- Question 17Multiple Select
Which activities are part of the Joiner-Mover-Leaver (JML) process?
- AJoiners receive initial access based on their roleCorrect answer
- BMovers receive updated permissions that reflect their new rolesCorrect answer
- CLeavers have all access revoked immediatelyCorrect answer
- DGuests are automatically converted to employee accounts
Why this is the answer
JML covers joiners receiving access, movers receiving updated permissions, and leavers being deprovisioned to avoid orphaned accounts.
- Question 18Interactive
The configuration in the code block represents a Lifecycle Workflow. Which identity event does it automate?
- AEmployee join
- BEmployee move
- CEmployee leaveCorrect answer
- DPassword reset
Why this is the answer
The workflow triggers on employeeLeave and removes access and deletes the account, matching offboarding.
- Question 19Single Choice
What is the main purpose of an Administrative Unit in Microsoft Entra ID?
- AThey delegate administrative permissions over a subset of users, groups, or devicesCorrect answer
- BThey create a separate Microsoft Entra tenant
- CThey replace the need for Conditional Access policies
- DThey synchronize on-premises passwords to the cloud
Why this is the answer
Administrative Units allow scoped administration, so admins manage only assigned resources without receiving full global privileges.
- Question 20Multiple Select
Which statements accurately reflect how dynamic group membership rules work in Microsoft Entra ID?
- AMembership changes are not always instantaneousCorrect answer
- BA required attribute that is null can prevent a user from being addedCorrect answer
- CRules are processed by the Microsoft Entra ID engine periodicallyCorrect answer
- DMembership is updated at the exact moment an attribute changes
Why this is the answer
Dynamic groups depend on periodic processing, so changes are not immediate; missing or badly formatted attributes can also block membership.
- Question 21Interactive
An attribute listed in the code block is mastered on-premises. What happens if an admin edits it in the Microsoft Entra admin center?
- AThe change is written back to on-premises Active Directory
- BThe edit is accepted and kept until the next sync
- CThe attribute is read-only and the change may be overwritten on the next sync cycleCorrect answer
- DThe edit immediately updates all dynamic groups
Why this is the answer
For synchronized attributes, the source of authority is on-premises, so Entra ID treats the value as read-only and a sync will overwrite portal changes.
- Question 22Single Choice
What is the purpose of password writeback in a hybrid identity environment?
- AIt enables self-service password reset for users synchronized from on-premises Active DirectoryCorrect answer
- BIt stores passwords in plaintext in the cloud
- CIt automatically assigns administrative units
- DIt allows external guests to change their home directory passwords
Why this is the answer
Password writeback sends cloud password changes to on-premises Active Directory, enabling SSPR for hybrid users.
- Question 23Multiple Select
Which statements correctly differentiate Security groups from Microsoft 365 groups?
- ASecurity groups are primarily used to grant access to resources such as files and appsCorrect answer
- BMicrosoft 365 groups provide a shared mailbox, calendar, and SharePoint site for collaborationCorrect answer
- CMicrosoft 365 groups are used to assign directory roles such as Global Administrator
- DSecurity groups provide a shared calendar and mailbox by default
Why this is the answer
Security groups focus on access to resources, while Microsoft 365 groups provide collaboration services like mailbox, calendar, and SharePoint.
- Question 24Interactive
The environment requirements in the code block indicate which synchronization tool should be selected?
- AMicrosoft Entra Cloud SyncCorrect answer
- BMicrosoft Entra Connect
- CSCIM provisioning
- DAzure AD Application Proxy
Why this is the answer
Cloud Sync is designed for simple scenarios that need a lightweight cloud-based agent and minimal on-premises footprint; Entra Connect targets complex forests.
Plan and implement identity governance
9 questions in this domain
- Question 25Single Choice
In the Joiner-Mover-Leaver (JML) process, what is the primary purpose of the Leaver phase?
- ATo assign new permissions based on role changes
- BTo revoke all access and deprovision the identity immediatelyCorrect answer
- CTo create a guest account for external collaboration
- DTo validate access through periodic recertification
Why this is the answer
The Leaver phase focuses on immediate deprovisioning and revoking all access when a user leaves. This prevents orphaned accounts and reduces the risk of security vulnerabilities.
- Question 26Multiple Select
Which two actions should be performed when offboarding a user to avoid orphaned or shadow identities?
- ARevoke access from all SaaS applications through automated provisioningCorrect answer
- BDisable or delete the identity from the directoryCorrect answer
- COnly revoke the password and keep the account active
- DMove the user to a different department before removing access
Why this is the answer
Proper offboarding requires both revoking application-specific access and disabling or deleting the directory identity. Relying only on password revocation or account disabling can leave shadow and orphaned identities active.
- Question 27Interactive
Review the Microsoft Entra ID group creation command. Which users will automatically become members of this group?
- AAll users whose department attribute equals SalesCorrect answer
- BAll users whose job title contains Sales
- CAll users who belong to a nested group
- DAll users manually added by an administrator
Why this is the answer
The membership rule evaluates the department attribute. Any user with department equal to Sales will be automatically added while the rule processing state is On.
- Question 28Single Choice
Which user attribute is most commonly used as the foundation for dynamic group membership and attribute-based access control?
- AdepartmentCorrect answer
- BthumbnailPhoto
- CmobilePhone
- DpasswordProfile
Why this is the answer
Attributes such as department, job title, and manager are commonly used in dynamic membership rules. They provide the foundational metadata for automated access decisions and ABAC.
- Question 29Multiple Select
Which two statements accurately describe Microsoft Entra Cloud Sync compared with Microsoft Entra Connect?
- AIt is a lightweight, cloud-based agent for simpler synchronization scenariosCorrect answer
- BIt is well suited for basic synchronization needs with easier managementCorrect answer
- CIt can only be used in complex multi-forest environments
- DIt requires a heavier on-premises footprint than Microsoft Entra Connect
Why this is the answer
Cloud Sync is a lightweight cloud-based agent designed for simpler requirements and easier management. Entra Connect is the heavier agent for complex multi-forest environments.
- Question 30Interactive
What identity governance process is being initiated by the Microsoft Graph PowerShell command shown?
- AAn access review of the finance groupCorrect answer
- BA dynamic membership rule update
- CPassword writeback configuration
- DSCIM provisioning to a SaaS application
Why this is the answer
The command creates an access review definition for the finance group members. Access reviews are used to periodically validate that users still require their assigned permissions.
- Question 31Single Choice
If an attribute is mastered in on-premises Active Directory and synchronized to Microsoft Entra ID, what happens when an administrator attempts to edit that attribute in the Microsoft Entra admin center?
- AThe attribute is read-only, and any attempted change is either blocked or overwritten by the next sync cycleCorrect answer
- BThe change is immediately written back to on-premises Active Directory
- CThe attribute can be edited only if the administrator is a Global Administrator
- DThe attribute is automatically replicated to all cloud tenants
Why this is the answer
When the source of authority is on-premises, the synchronized attribute is read-only in the cloud portal. Direct edits are blocked or overwritten during the next synchronization cycle.
- Question 32Multiple Select
Which two statements best describe synchronization behavior in a hybrid identity environment?
- AChanges made on-premises are not reflected in Microsoft Entra ID instantaneouslyCorrect answer
- BThe default synchronization interval for Microsoft Entra Connect is typically about 30 minutesCorrect answer
- CSynchronization is triggered only when a user resets their password
- DAttribute changes instantly appear in Microsoft Entra ID after the portal edit
Why this is the answer
Hybrid synchronization is not instantaneous. Entra Connect has a typical sync interval of about 30 minutes, so administrators must account for latency when troubleshooting identity changes.
- Question 33Interactive
Review the SCIM bulk request. Which identity provisioning action is being performed?
- ACreating a new user in a SaaS application via automatic provisioningCorrect answer
- BDeleting a user from the directory
- CUpdating a user's manager attribute
- DStarting an access review
Why this is the answer
The SCIM bulk request uses POST to /Users with user data, which creates a new user in the target SaaS application. This is part of automated provisioning via SCIM.
Plan and implement workload identities
9 questions in this domain
- Question 34Single Choice
What is the primary purpose of implementing identity lifecycle management for users in Microsoft Entra ID?
- AGrant access when needed and revoke when leavingCorrect answer
- BKeep all user accounts permanently active
- CStore user passwords in plain text
- DReplace Conditional Access policies
Why this is the answer
Identity lifecycle management ensures access is granted during onboarding and revoked at offboarding, preventing ghost accounts and security vulnerabilities.
- Question 35Multiple Select
Which three phases are included in the Joiner-Mover-Leaver (JML) framework for identity lifecycle management in Microsoft Entra ID?
- AJoinerCorrect answer
- BMoverCorrect answer
- CLeaverCorrect answer
- DReviewer
Why this is the answer
The JML framework includes Joiner, Mover, and Leaver phases to grant initial access, adjust permissions on role changes, and revoke all access when a user leaves.
- Question 36Interactive
An administrator applies the expression in the code block to a Microsoft Entra ID group. Which type of group membership is being configured?
- ADynamic membershipCorrect answer
- BAssigned membership
- CExternal membership
- DHybrid membership
Why this is the answer
A rule based on user attributes such as department defines dynamic membership, so membership is evaluated by the Entra ID engine rather than assigned manually.
- Question 37Single Choice
Which tool is recommended for complex multi-forest synchronization between on-premises Active Directory and Microsoft Entra ID?
- AMicrosoft Entra ConnectCorrect answer
- BEntra Cloud Sync
- CSCIM provisioning
- DPassword writeback
Why this is the answer
Microsoft Entra Connect is the heavy-duty agent designed for complex, multi-forest environments that require advanced synchronization features.
- Question 38Multiple Select
Which statements correctly describe how dynamic membership rules work in Microsoft Entra ID for group management?
- AMembership is based on user attributesCorrect answer
- BMembership changes use a propagation delayCorrect answer
- CNull attributes can prevent membershipCorrect answer
- DMembership updates happen instantly
Why this is the answer
Dynamic membership rules use user attributes, require valid attribute values, and are processed with a propagation delay before membership updates appear.
- Question 39Interactive
The command in the code block is run for a user who is synchronized from on-premises Active Directory. What is the likely result?
- AThe change is overwritten during the next sync cycleCorrect answer
- BThe change is permanently stored in Microsoft Entra ID
- CThe user is immediately deleted
- DThe command creates a new on-premises user
Why this is the answer
If an attribute is mastered on-premises, editing it in the cloud is overwritten during the next Entra Connect synchronization cycle.
- Question 40Single Choice
What is the main purpose of creating an Administrative Unit in Microsoft Entra ID for identity management?
- ADelegate scoped administrative permissionsCorrect answer
- BStore external user credentials
- CReplace Conditional Access policies
- DAutomate SaaS application provisioning
Why this is the answer
Administrative Units allow scoped management by delegating permissions over specific users, groups, or devices without granting global privileges.
- Question 41Multiple Select
Which three collaboration capabilities are included with Microsoft 365 groups but not with security groups?
- AShared mailboxCorrect answer
- BShared calendarCorrect answer
- CSharePoint siteCorrect answer
- DDevice enrollment
Why this is the answer
Microsoft 365 groups provide collaboration resources such as a shared mailbox, calendar, and SharePoint site, while security groups primarily grant access.
- Question 42Interactive
The code block contains a SCIM payload sent to a SaaS application. What identity operation does this payload represent?
- ADeprovisioning the userCorrect answer
- BProvisioning a new user
- CUpdating a user password
- DAssigning a dynamic group
Why this is the answer
The SCIM payload sets 'active' to false, signaling the SaaS application to disable the user account in a deprovisioning scenario.
Frequently asked questions
Everything about the Microsoft Certified: Identity and Access Administrator Associate question bank and how to use it.