Tenant restrictions function by intercepting authentication requests to Azure AD and require client applications to use modern authentication (OAuth 2.0). Outlook 2013 does not support modern authentication by default and relies on legacy protocols. While modern authentication can be enabled for Outlook 2013 via registry modifications, the client itself is past its support lifecycle. To ensure tenant restrictions work reliably and to align with security best practices, the required first step is to upgrade the non-compliant clients to a version that natively supports modern authentication, such as Outlook 2016. This addresses the prerequisite compatibility issue directly.

B. Configuring Outlook 2013 for modern authentication is a temporary fix on an unsupported client, which is not a reliable long-term solution for a modern security feature.

C. Upgrading all clients, including the already-compliant Outlook 2016 clients, creates more administrative effort than necessary, violating the stated requirement.

D. Organization Sharing is an Exchange feature for sharing calendar information between tenants and is unrelated to Azure AD tenant restrictions, which control application sign-ins.

1. Microsoft Learn. How modern authentication works for Office 2013

Office 2016

Office 2019

and Microsoft 365 Apps. "Modern authentication is not enabled by default in Office 2013. You must enable it... Modern authentication is enabled by default in... Office 2016." This document establishes the fundamental difference in the clients mentioned in the scenario.

2. Microsoft Learn. Use tenant restrictions to manage access to SaaS cloud applications. Under the "How it works" section

it states

"The solution is for applications that use modern authentication... For applications that use legacy authentication

these protections do not work." This confirms that modern authentication is a mandatory prerequisite for tenant restrictions to be effective.

3. Microsoft Learn. Office 2013 - Microsoft Lifecycle. This document confirms that extended support for Office 2013 ended on April 11

2023. Implementing new security controls on unsupported software is not a recommended practice

making an upgrade the appropriate first step.

The scenario requires a multi-factor authentication (MFA) method that functions when a user's laptop has wired internet, but their mobile phone has no connectivity (neither Wi-Fi nor cellular). Windows Hello for Business is the only suitable option. It satisfies MFA requirements by combining something the user has (the physical laptop with a securely stored cryptographic key) with something the user knows (a PIN) or something the user is (a biometric gesture). This authentication process occurs on the laptop and uses its internet connection to communicate with Azure AD, making it independent of any mobile phone connectivity.

A. a notification through the Microsoft Authenticator app: This method requires the mobile phone to have an active internet connection (Wi-Fi or cellular data) to receive the push notification, which is unavailable.

B. an app password: App passwords are a legacy workaround for older applications that do not support modern authentication and cannot prompt for MFA; they are not a primary MFA method for interactive user sign-ins.

D. SMS: This method relies on the user receiving a text message, which requires cellular network connectivity on the mobile phone. The scenario explicitly states this is not available.

1. Windows Hello for Business: Microsoft Learn

How Windows Hello for Business works - Authentication. This document explains

"Windows Hello for Business is a strong two-factor credential that people can use to sign in to their Windows device... The two factors are something you have (your device with its TPM) and something you know (your PIN) or something you are (your biometric)." This confirms it is a valid MFA method that is self-contained on the device.

2. Authenticator App Notifications: Microsoft Learn

How to use the Microsoft Authenticator app. In the section "Respond to a sign-in notification

" the prerequisite is clear: "If you enabled push notifications... your phone must be connected to the internet." This directly contradicts the scenario's constraints.

3. SMS Authentication: Microsoft Learn

Authentication methods in Azure Active Directory - SMS. The "How it works" section details that "a text message containing a verification code is sent to the mobile phone number." This process is impossible without cellular service.

4. App Passwords: Microsoft Learn

Manage app passwords for two-step verification. This page states

"App passwords are for apps that don't support modern authentication... If you have multi-factor authentication set up for your organization

you should try to use modern authentication." This positions app passwords as a fallback for legacy apps

not a primary MFA method for a user's main sign-in.

HighRiskCountries: In Microsoft Entra Conditional Access, named locations (which can contain a list of IP address ranges or specific countries/regions) are referenced under the Locations setting. The locations setting is categorized under the policy's Conditions assignment block.

Sign-in frequency: To restrict the time duration for which a user can remain authenticated before being prompted to sign in again, you must manage the session lifetime. This configuration is done via Sign-in frequency, which is explicitly categorized as A session control under the Access Controls section of the policy.

Microsoft Entra ID Official Vendor Documentation: How to Use Conditions in Conditional Access Policies (Section: "Network location" / "Locations" condition).

Microsoft Entra ID Official Vendor Documentation: Conditional Access adaptive session lifetime policies (Section: "User sign-in frequency" under Session controls).

Number of days: When a user is deleted from Microsoft Entra ID (Azure AD), the account enters a "soft-deleted" or suspended state for 30 days. During this window, the account and its associated properties can be fully recovered. Once this period expires, the object is permanently deleted and becomes unrecoverable.

Role: The User administrator is the least privileged built-in identity role that can manage all aspects of user accounts, including deleting and restoring soft-deleted directory user objects. Other listed roles, such as Helpdesk administrator, are constrained to tasks like password resets and service health checks but lack authority to restore deleted accounts.

Microsoft Learn — Recover deleted data - Microsoft Entra PowerShell Section: "Step 2: Restore soft-deleted users" — Specifies that accounts remain in a suspended state for 30 days, after which they are permanently deleted.Microsoft Learn — Restore a user - Microsoft 365 admin Section: "Restore one or more user accounts" — Verifies the 30-day recovery policy and notes that you must be a User Administrator to perform the action.Microsoft Learn — About administrator roles in the Microsoft 365 admin center Section: "User Administrator" and "Helpdesk Administrator" — Delineates the task constraints between different administrative roles.Microsoft Learn — Restore-EntraDeletedDirectoryObject (Microsoft.Entra.DirectoryManagement) Section: "Description" — Confirms delegated permissions require the User Administrator role to restore deleted user objects.

The requirement states that "The helpdesk administrators must be able to manage licenses for only the users in their respective office."

To restrict administrative privileges (such as license management) to a specific subset of users within a tenant, you must use Administrative Units (AUs). Creating an administrative unit for each branch office allows you to scope the helpdesk administrators' roles (like the License Administrator or Helpdesk Administrator role) specifically to the users within that branch office.

The Azure Active Directory admin center (or Microsoft Entra admin center) is the primary tool used to create administrative units, manage their membership, and assign scoped administrative roles to users.

Microsoft Entra ID / Azure AD Documentation: Section on "Designate administrative units for scoped role delegation" and "Assign Azure AD roles with administrative unit scope".

Exam SC-300 / MS-102 Case Studies: Technical requirements for identity management and administrative scoping using AUs.

First Dropdown (Authentication methods): To satisfy the requirement that users must be prompted to respond to a mobile app notification or answer three predefined security questions, you must configure the Authentication methods section under the Password reset blade. This section allows administrators to specify the number of methods required to reset a password and choose which specific options (such as mobile app notification or security questions) are available to users.

Second Dropdown (Password writeback): Azure AD Connect Express Settings already configures Password Hash Synchronization (PHS), which synchronizes passwords from the on-premises Active Directory domain to Microsoft Entra ID (Azure AD). To ensure passwords are synchronized regardless of where the password was reset (specifically allowing cloud-initiated resets via SSPR to sync back to the on-premises environment), you must enable Password writeback within Azure AD Connect.

Microsoft Learn Documentation: Browse authentication methods for self-service password reset (SSPR)

Section: "Available authentication methods"

Detail: Outlines how to configure specific authentication gates—including security questions and mobile app notifications—within the Authentication methods menu of the SSPR configuration blade.

Microsoft Learn Documentation: Tutorial: Enable Microsoft Entra self-service password reset writeback to an on-premises environment

Section: "Enable password writeback option in Azure AD Connect"

Detail: Explains that password writeback is an asynchronous feature enabled in Azure AD Connect that writes cloud-based password resets back to an on-premises directory in real-time.

Statement 1 (Yes): Secret1 was deleted from KeyVault2 on June 1. KeyVault2 has a retention period of 10 days, meaning the secret remains in a recoverable soft-deleted state until June 11. Admin1 is assigned the Key Vault Administrator role, which is a data-plane role that grants full permission to perform all key, secret, and certificate operations, including recovery (Microsoft.KeyVault/vaults/secrets/recover/action). Therefore, Admin1 can successfully recover it on June 7.

Statement 2 (No): Certificate1 is located in KeyVault1, which has Purge protection enabled. When purge protection is enabled, no user—regardless of their assigned role or permissions—can manually purge a deleted object until the mandatory retention period has fully expired.

Statement 3 (No): Certificate1 was deleted on June 1 and has a 15-day retention period, meaning the retention period expires on June 16. Because purge protection is enabled on KeyVault1, the certificate cannot be purged by anyone on June 14, as this date falls within the mandatory 15-day retention window. Furthermore, after June 16, Azure Key Vault will automatically purge the item; manual intervention is restricted.

Microsoft Learn: Azure Key Vault soft-delete overview. "Purge protection: When purge protection is on, a vault or an object in the deleted state cannot be purged until the retention period has passed. Soft-deleted vaults and objects can still be recovered, ensuring that the retention policy will be followed."

Source: https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection

Microsoft Learn: Azure built-in roles for Key Vault data plane operations. Details the permissions of the Key Vault Administrator role, explicitly listing the recovery actions permitted during the soft-delete retention window.

Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-administrator

The solution requires two key actions. First, a special type of group, known as a "role-assignable group," must be created. This is achieved by setting the "Azure AD roles can be assigned to the group" property to "Yes" during group creation. Only role-assignable groups can be assigned Azure AD roles.

Second, to allow members to activate the role, the group must be given an "Eligible" assignment for the Security Reader role within Azure AD Privileged Identity Management (PIM). An eligible assignment means that members of the group do not have the role permissions by default but can elevate their privileges to activate the role when needed.

1. Microsoft Learn Documentation

"Create a role-assignable group in Azure Active Directory." This document explicitly details the process of creating a group that can be assigned an Azure AD role.

Reference: Under the section "Create a role-assignable group

" Step 5 states: "For Azure AD roles can be assigned to the group

select Yes." This confirms the critical setting for the group creation.

Source: https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-create-rule

2. Microsoft Learn Documentation

"Assign Azure AD roles in Privileged Identity Management." This guide explains how to assign roles to principals (including groups) using PIM and clarifies the difference between "Eligible" and "Active" assignments.

Reference: Under the section "Assign a role

" the steps outline selecting a role

adding an assignment

and choosing the assignment type. The description for "Eligible" assignment type states

"Eligible assignments require the member to perform an action to use the role." This directly corresponds to the question's requirement that members "can activate" the role.

Source: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user

3. Microsoft Learn Documentation

"Use Azure AD groups to manage role assignments." This document provides the conceptual background for using groups to manage roles.

Reference: In the "Overview" section

it states: "To assign a role to a group

it must be created with the isAssignableToRole property set to true. In the Azure portal

you set the Azure AD roles can be assigned to the group option to Yes." This reinforces the prerequisite for the group's configuration.

Source: https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept

File1 (Blob Container): Azure role-based access control (RBAC) separates management (control plane) and data (data plane) operations. User2 is explicitly assigned the Storage Blob Data Reader role, which provides data plane access to read blob contents. User3 is assigned the Storage Contributor role; while this is a management role that does not directly grant Entra ID data access, it contains the Microsoft.Storage/storageAccounts/listkeys/action permission. This allows User3 to retrieve the storage account access keys and use them to read the blob data. User1 holds only the Reader role, which permits viewing the resource but denies both data access and key retrieval.

File2 (File Share): To read files within an Azure File share via standard management interfaces (like the Azure Portal), a user must authenticate using the storage account access keys. User3's Storage Contributor role allows them to retrieve these keys, granting access to File2. Neither User1 (Reader) nor User2 (Storage Blob Data Reader) possess permissions to list the storage account keys or read file share data, making them unable to access File2.

Azure built-in roles - Storage Contributor: Official documentation detailing that the Storage Contributor role grants full management access, including the ability to list access keys (Microsoft.Storage/storageAccounts/listkeys/action).

Link: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-contributor

Azure built-in roles - Storage Blob Data Reader: Official documentation detailing the specific DataActions granted, specifically Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read, which allows reading blob content.

Link: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-reader

Authorize access to data in Azure Storage: Official architectural overview explaining how control plane permissions (access keys) and data plane permissions (Azure AD RBAC) are evaluated independently for data access.

Link: https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad

Can expire: Microsoft Entra ID (formerly Azure AD) group expiration policies are exclusively supported for Microsoft 365 groups. Expiration lifecycle policies cannot be applied to Security groups, Mail-enabled security groups, or Distribution lists. In the provided scenario, Group2 is the only Microsoft 365 group, making it the only valid selection for expiration configuration.

Shortest lifetime: When configuring the expiration policy in the Entra ID admin center, administrators can set the group lifetime using preset values (such as 180 or 365 days) or by defining a custom value in days. Official Microsoft specifications strictly require that any custom expiration lifetime value must be at least 30 days.

Microsoft Learn - Microsoft Entra ID Documentation: "Configure the expiration policy for Microsoft 365 groups"

Section Reference: Under the "Set group expiration" section, the documentation explicitly states: "You can select one of the preset values or a custom value. It should be 30 days or more."

Section Reference: The documentation also clarifies the operational scope under the same section: "Select which Microsoft 365 groups expire," confirming this feature does not extend to traditional security or distribution groups.

Microsoft Learn - Microsoft 365 Solutions: "Microsoft 365 group expiration policy"

Section Reference: Under "How to set the expiration policy," it reiterates the minimum threshold: "The custom value has to be at least 30 days."