To connect on-premises Linux devices to Global Secure Access for Internet Access, a network-level connection is required. This is because the Global Secure Access Client software is currently only available for Windows devices. The correct method is to create a remote network, which establishes a secure IPsec VPN tunnel from the on-premises network's edge router or firewall to the Global Secure Access service. This configuration routes all outbound internet traffic from devices within that network, including the Linux devices, through the Microsoft Security Service Edge (SSE) solution without requiring any client software on the individual endpoints.

A. Deploy a private network connector.

This is incorrect. Private network connectors are components of Microsoft Entra Private Access, used to provide secure access to on-premises applications, not for forwarding general internet traffic.

B. Configure the Adaptive Access settings.

This is incorrect. Adaptive Access is a feature for applying granular, risk-based Conditional Access policies to traffic after connectivity to Global Secure Access has been established.

C. Install the Azure Connected Machine agent on the devices.

This is incorrect. The Azure Connected Machine agent is part of Azure Arc and is used to manage on-premises servers with Azure management services; it does not function as a network client for Global Secure Access.

1. Microsoft Entra documentation

"How to configure remote network connectivity for Microsoft Entra Internet Access." This document explicitly states

"You can connect remote networks

such as a branch office location

to Global Secure Access... This remote network connectivity creates an IPsec tunnel from your on-premises customer premises equipment (CPE) to the nearest Global Secure Access endpoint." This is the client-agnostic method that supports devices like Linux.

2. Microsoft Entra documentation

"The Global Secure Access Client for Windows (preview)." This source confirms that the endpoint client is specifically for the Windows operating system

thereby necessitating a different approach (remote network) for other operating systems like Linux.

3. Microsoft Entra documentation

"Configure connectors for Microsoft Entra Private Access." This document clarifies the role of connectors: "Connectors are lightweight agents that sit on-premises... The connector facilitates the outbound connection to the Global Secure Access service." This confirms their use is for Private Access

not Internet Access.

4. Azure Arc documentation

"Azure Connected Machine agent overview." This source details the agent's purpose: "The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network... This agent does not replace the Azure Log Analytics agent... or any other agent that you use to monitor or manage your server." This confirms its role is for management

not network traffic forwarding for Global Secure Access.

The solution correctly addresses the goal. Microsoft Defender for Cloud Apps utilizes App Connectors to integrate with third-party SaaS applications via their APIs. By adding the Google Workspace app connector, you grant Defender for Cloud Apps the necessary permissions to access activity logs and metadata from your Google Workspace environment. This connection is the specific mechanism required to discover and monitor OAuth applications that users have authorized, thereby enabling you to assess their permissions, usage, and potential risk. This action directly fulfills the requirement to monitor OAuth authentication requests for the Google Workspace portion of the organization's cloud presence.

B. No: This is incorrect. Connecting a supported application like Google Workspace is the standard and required procedure within Defender for Cloud Apps to gain visibility into its activities, which explicitly includes OAuth app authorizations and usage.

1. Microsoft Learn. "Connect Google Workspace to Microsoft Defender for Cloud Apps." Microsoft Docs. Accessed October 2023. In the overview section

it details the capabilities gained after connection

which includes visibility into activities and governance

the foundation for monitoring OAuth apps. The process described is exactly what the solution proposes.

2. Microsoft Learn. "Investigate and manage risky OAuth apps." Microsoft Docs. Accessed October 2023. This document states

"Defender for Cloud Apps uses the API connectors to pull a list of OAuth apps that are authorized by your users in connected apps such as Microsoft 365

Google

and Salesforce." This directly confirms that the app connector is the prerequisite for monitoring OAuth apps.

3. Microsoft Learn. "How Defender for Cloud Apps helps protect your Google Workspace environment." Microsoft Docs. Accessed October 2023. This document outlines the protection capabilities

including "Detecting threats from user and app activities

" which encompasses the monitoring of OAuth applications connected to the environment.

For an application (service principal) like App1 to authenticate itself and access another application's API like App2, it must present its own credentials. The Microsoft identity platform supports two primary types of credentials for application identities. The first is a client secret, which is a string value that acts as an application-specific password. The second, and more secure, method is a certificate. With this method, the application uses its private key to sign a JSON Web Token (JWT) assertion, which is then used to prove its identity to Microsoft Entra ID. Both methods allow the application to authenticate without any user interaction, which is typical for service-to-service communication.

B. managed identity: A managed identity is an identity for an Azure resource (e.g., a VM or App Service), not a credential type that is configured on a generic application registration itself.

D. user account: A user account is used for delegated authentication, where an application acts on behalf of a signed-in user, not for authenticating the application itself.

E. one-time password: This is a form of multi-factor authentication for user accounts and is not applicable to application service principals.

1. Microsoft Entra documentation

"Application and service principal objects in Microsoft Entra ID": Under the "Service principal authentication" section

it states: "The Microsoft identity platform supports two types of authentication for service principals: password-based authentication (client secret) and certificate-based authentication." This directly confirms that certificates and secrets are the valid credential types.

2. Microsoft identity platform documentation

"Microsoft identity platform and the OAuth 2.0 client credentials flow": This document details the protocol for service-to-service calls. In the "Get a token" section

it shows two distinct protocol requests: the first uses a clientsecret parameter

and the second uses a clientassertion parameter

which is a JWT signed by a certificate. This demonstrates the two credential mechanisms at the protocol level.

3. Microsoft Entra documentation

"Quickstart: Register an application with the Microsoft identity platform": In the "Add credentials" section

the steps guide the user to add either a "Client secret" or a "Certificate" to the application registration

reinforcing these are the two available options.

The current access review configuration in image_d03e22.png uses the Manager as the designated reviewer, with Megan Bowen defined as the fallback reviewer. Because all requests are falling back to Megan Bowen, the system is unable to determine a valid manager for the users under review (likely due to the manager attribute being unconfigured in Microsoft Entra ID for these accounts).

Creating a separate access review for each role does not address the root issue of missing manager attributes, nor does it dynamically align review routing by department. To meet the goal, you should either ensure the manager property is properly populated for all administrators or create separate access reviews targeted at specific groups or departments with their respective department heads explicitly assigned as reviewers.

A. Yes: Creating separate reviews by role does not change the reviewer routing logic or fix missing user-manager relationships, meaning requests will continue going to the fallback reviewer.

Microsoft Official Documentation: What are Microsoft Entra access reviews? & Create an access review of Azure AD roles in Privileged Identity Management (PIM). Section: "Advanced / Reviewers selection" (Specifies that if 'Manager' is chosen and a user has no manager assigned in the directory, the review falls back to the designated fallback reviewer).

The Azure AD audit logs are the definitive source for tracking administrative and policy-related events within a tenant. When a user is presented with a Terms of Use (ToU) policy and either accepts or declines it, a specific audit event is generated. These logs capture the user's identity, the timestamp of the action, and the outcome (accept or decline). By filtering the audit logs for the "UserManagement" category and activities related to "Accept terms of use policy" or "Decline terms of use policy," an administrator can accurately identify the status for each user regarding "Terms1".

A. provisioning logs: These logs track the creation, update, and deletion of users and groups, typically related to automated provisioning, not user consent actions.

B. the Usage and Insights report: This provides aggregated data and trends on application usage and sign-in activity, not granular, event-level details of ToU acceptance.

C. sign-in logs: These logs record user authentication events. While a ToU may be part of the sign-in flow, the log's primary focus is on the sign-in itself, not the specific consent action.

1. Microsoft Learn | Azure Active Directory documentation. "Monitor and report on terms of use." This document explicitly states

"The Azure AD audit logs record user activity

including consent to a terms of use policy... To view who has and has not accepted a ToU policy

in Azure Active Directory

select Terms of use. Select a terms of use policy. Under Monitor

select Accepted." The underlying data for this view is sourced from the audit logs. The document further details filtering the audit log for the "Accept terms of use policy" activity.

2. Microsoft Learn | Azure Active Directory documentation. "Audit log activities." This reference lists all activities recorded in the audit logs. Under the "User management" category

it includes "Accept terms of use policy" and "Decline terms of use policy" as specific

logged events.

3. Microsoft Learn | Azure Active Directory documentation. "What are Azure Active Directory reports?" This document describes the different types of reports. It clarifies that audit logs capture "a record of all events that occur in your tenant

" while sign-in logs capture "information about the usage of managed applications and user sign-in activities

" confirming the distinct purpose of each log.

Security defaults in Microsoft Entra ID provide a baseline level of security but are mutually exclusive with Conditional Access policies. When Security defaults are enabled, which is the standard for new tenants, all options to create and manage Conditional Access policies are unavailable (grayed out). To gain the granular control offered by Conditional Access, an administrator must first explicitly disable the tenant-wide Security defaults. This action makes the Conditional Access policy configuration interface accessible, allowing for the creation of custom access rules.

A. Disable the User consent settings: User consent settings manage application permissions and are not a prerequisite for enabling or configuring Conditional Access policies.

C. Configure a multi-factor authentication (MFA) registration policy: An MFA registration policy is typically configured using a Conditional Access policy, not before. Disabling Security defaults is the necessary first step to even create such a policy.

D. Configure password protection for Windows Server Active Directory: This is a separate identity protection feature for hybrid environments and has no direct dependency on or bearing on the ability to configure Conditional Access policies in Azure.

1. Microsoft Entra documentation

"Security defaults in Microsoft Entra ID":

Section: "Disabling security defaults"

Content: "If you want to use Conditional Access policies to replace security defaults

you must disable security defaults... Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults." This explicitly states that disabling security defaults is a required step before using Conditional Access.

2. Microsoft Entra documentation

"Conditional Access and security defaults":

Section: "Conditional Access and security defaults"

Content: "If you're a customer using security defaults

you must disable security defaults to enable Conditional Access." This confirms the mutual exclusivity and the required order of operations.

To control Multi-Factor Authentication (MFA) based on a user's physical location, such as a specific office, you must use the location condition within an Azure AD Conditional Access policy. Azure AD identifies a user's location by their source public IP address. The Named Locations feature allows you to define a trusted location, like the Boston office, by specifying its public IP address range(s). This named location can then be used in a Conditional Access policy to either require or bypass MFA for users connecting from that network, thereby meeting the specified requirements.

A. named locations that have a private IP address range: Azure AD is a cloud service and cannot see the internal private IP addresses (e.g., 10.0.0.0/8) of a corporate network; it only sees the public-facing IP.

C. trusted IPs that have a public IP address range: "Trusted IPs" is a legacy feature within the MFA service settings. While functional, the modern and recommended best practice is to use Named Locations with Conditional Access for more granular and flexible policy control.

D. trusted IPs that have a private IP address range: The legacy "Trusted IPs" feature, like Named Locations, operates on public IP addresses, as Azure AD has no visibility into an organization's internal private network ranges.

---

1. Microsoft Azure Documentation

"Use the location condition in a Conditional Access policy": This document explicitly states how to configure locations for use in Conditional Access. In the section "Configure IP address ranges location

" it clarifies

"You can mark IP address ranges that represent your organization's on-premises network in Azure AD as a named location... Private IP ranges cannot be specified." This supports using public IP ranges and directly refutes options involving private IPs.

Source: Microsoft Corporation. (2023). Use the location condition in a Conditional Access policy. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#configure-ip-address-ranges-location

2. Microsoft Azure Documentation

"Configure Azure AD Multi-Factor Authentication settings": This document describes the "Trusted IPs" feature and its limitations. It notes

"If you're using Conditional Access

trusted IPs must be configured as a named location." This confirms that for modern policy-based control

Named Locations is the correct and integrated feature to use

making it superior to the legacy "Trusted IPs" option.

Source: Microsoft Corporation. (2023). Configure Azure AD Multi-Factor Authentication settings. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips

The recommended solution is to use a Network Policy Server (NPS) with the Azure AD Multi-Factor Authentication extension. The on-premises VPN server, acting as a RADIUS client, sends authentication requests to the NPS. The NPS extension then communicates with Azure AD to enforce the user's MFA policy, providing a second factor of authentication. This architecture allows organizations to secure their existing RADIUS-based authentication infrastructure, such as VPNs, with cloud-based Azure MFA without replacing the core hardware. The primary authentication still occurs against the on-premises Active Directory.

A. Azure AD Application Proxy: This service is designed to publish on-premises web applications for secure remote access, not for integrating MFA with RADIUS clients like a VPN server.

B. an Azure AD Password Protection proxy: This component extends Azure AD's custom banned password lists and smart lockout features to an on-premises Active Directory. It does not provide MFA.

D. a pass-through authentication proxy: This is an Azure AD Connect agent that validates user passwords directly against on-premises Active Directory for sign-in. It is not a RADIUS proxy for MFA.

---

1. Microsoft Learn. "Integrate your existing Network Policy Server (NPS) infrastructure with Azure AD Multi-Factor Authentication." Microsoft Entra Documentation. This document explicitly states

"The NPS extension for Azure AD MFA adds cloud-based MFA capabilities to your on-premises infrastructure... The NPS extension acts as an adapter between RADIUS and cloud-based Azure AD MFA to provide a second factor of authentication for... users." It includes a diagram showing a VPN server as a RADIUS client connecting to an NPS server with the extension.

2. Microsoft Learn. "Plan an Azure AD Multi-Factor Authentication deployment." Microsoft Entra Documentation. In the section "Choose your authentication methods

" it details using the NPS extension for on-premises applications: "For on-premises apps that use RADIUS authentication

the best option is to deploy an NPS server with the Azure AD MFA NPS extension."

3. Microsoft Learn. "What is Application Proxy?" Microsoft Entra Documentation. This source clarifies the purpose of Application Proxy: "Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications." This confirms it is not suitable for RADIUS/VPN authentication.

4. Microsoft Learn. "Deploy on-premises Azure AD Password Protection." Microsoft Entra Documentation. This document describes the role of the proxy service as part of the Password Protection feature

which is unrelated to providing MFA for authentication requests.

The scenario describes an application that runs as a service without user interaction, often referred to as a daemon or background service. For such applications to access a protected API like Microsoft Graph, they must use application permissions. These permissions are granted directly to the application's identity (its service principal) by an administrator. The application authenticates using its own credentials (like a client secret or certificate) and receives an access token that is not associated with any user. This is the correct model for non-interactive, server-to-server scenarios.

B. delegated permissions: These are incorrect because they require a signed-in user to be present. The application would be acting on behalf of that user, and the scenario explicitly states the app runs "without user interaction."

C. a custom role-based access control (RBAC) role: This is incorrect. Microsoft Entra RBAC roles grant permissions to manage Microsoft Entra resources, but the primary mechanism for an app to be authorized for an API call is through API permissions.

D. a built-in role-based access control (RBAC) role: This is incorrect for the same reason as custom RBAC roles. While a service principal can be assigned a role, the authorization to call the Microsoft Graph API is governed by the granted API permissions.

1. Microsoft Entra ID documentation

"Permission types": "Application permissions are used by apps that run without a signed-in user present; for example

apps that run as background services or daemons. Application permissions can only be consented to by an administrator."

Source: Microsoft Learn

Permissions and consent in the Microsoft identity platform

Section: "Permission types".

2. Microsoft Graph documentation

"Permissions overview": "For scenarios without a signed-in user

the app can be granted application permissions... Application permissions are also known as app-only access. The app is authorized to call the API based on the permissions that have been granted directly to the app by an administrator."

Source: Microsoft Learn

Microsoft Graph permissions overview

Section: "Permission types".

3. Microsoft Entra ID documentation

"Microsoft identity platform and the OAuth 2.0 client credentials flow": This document details the authentication flow for service-to-service calls. "In the client credentials flow

permissions are granted directly to the application itself. When the app presents a token to a resource

the resource enforces that the app itself has authorization to perform an action since there is no user involved in the authentication."

Source: Microsoft Learn

Microsoft identity platform and the OAuth 2.0 client credentials flow

Section: "Protocol diagram".

Azure attribute-based access control (ABAC) adds conditions to role assignments to provide more fine-grained access control. Currently, conditions are supported for built-in or custom role assignments that include storage data actions, specifically for Azure Blob Storage and Azure Queue Storage.

The Storage Blob Data Reader role is a data plane role with storage data actions, making it eligible for ABAC conditions. The other roles listed—Reader, Contributor, and Virtual Machine Contributor—are Azure Resource Manager (management plane) roles and do not currently support the addition of ABAC conditions.

A. User1: The Reader role is a management plane role that grants read access to management resources and does not support ABAC conditions.

B. User2: The Contributor role is a management plane role that grants full access to manage resources but does not support ABAC conditions.

D. User4: The Virtual Machine Contributor role is a management plane role for managing virtual machines and does not support ABAC conditions.

1. Microsoft Learn. "What is Azure attribute-based access control (Azure ABAC)?". Microsoft Docs. Accessed October 2023. In the section "Where can I add conditions?"

it states

"Currently

conditions can be added to built-in or custom role assignments that have storage blob data actions or storage queue data actions." This confirms that only storage data roles support ABAC.

2. Microsoft Learn. "Prerequisites for Azure role assignment conditions". Microsoft Docs. Accessed October 2023. This document outlines the requirements for using ABAC

emphasizing its application to storage accounts and roles with storage data actions

such as Storage Blob Data Reader

Storage Blob Data Contributor

and Storage Blob Data Owner.

3. Microsoft Learn. "Actions and attributes for Azure role assignment conditions for Azure Storage". Microsoft Docs. Accessed October 2023. This page provides a comprehensive list of the attributes and data actions (e.g.

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read) that can be used in conditions

all of which are specific to Azure Storage

thereby excluding management plane roles like Reader and Contributor.