Free SC-300 Practice Test Questions and Answers (2026)

To connect on-premises Linux devices to Global Secure Access for Internet Access, a network-level connection is required. This is because the Global Secure Access Client software is currently only available for Windows devices. The correct method is to create a remote network, which establishes a secure IPsec VPN tunnel from the on-premises network's edge router or firewall to the Global Secure Access service. This configuration routes all outbound internet traffic from devices within that network, including the Linux devices, through the Microsoft Security Service Edge (SSE) solution without requiring any client software on the individual endpoints.

A. Deploy a private network connector.

This is incorrect. Private network connectors are components of Microsoft Entra Private Access, used to provide secure access to on-premises applications, not for forwarding general internet traffic.

B. Configure the Adaptive Access settings.

This is incorrect. Adaptive Access is a feature for applying granular, risk-based Conditional Access policies to traffic after connectivity to Global Secure Access has been established.

C. Install the Azure Connected Machine agent on the devices.

This is incorrect. The Azure Connected Machine agent is part of Azure Arc and is used to manage on-premises servers with Azure management services; it does not function as a network client for Global Secure Access.

1. Microsoft Entra documentation

"How to configure remote network connectivity for Microsoft Entra Internet Access." This document explicitly states

"You can connect remote networks

such as a branch office location

to Global Secure Access... This remote network connectivity creates an IPsec tunnel from your on-premises customer premises equipment (CPE) to the nearest Global Secure Access endpoint." This is the client-agnostic method that supports devices like Linux.

2. Microsoft Entra documentation

"The Global Secure Access Client for Windows (preview)." This source confirms that the endpoint client is specifically for the Windows operating system

thereby necessitating a different approach (remote network) for other operating systems like Linux.

3. Microsoft Entra documentation

"Configure connectors for Microsoft Entra Private Access." This document clarifies the role of connectors: "Connectors are lightweight agents that sit on-premises... The connector facilitates the outbound connection to the Global Secure Access service." This confirms their use is for Private Access

not Internet Access.

4. Azure Arc documentation

"Azure Connected Machine agent overview." This source details the agent's purpose: "The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network... This agent does not replace the Azure Log Analytics agent... or any other agent that you use to monitor or manage your server." This confirms its role is for management

not network traffic forwarding for Global Secure Access.

The solution correctly addresses the goal. Microsoft Defender for Cloud Apps utilizes App Connectors to integrate with third-party SaaS applications via their APIs. By adding the Google Workspace app connector, you grant Defender for Cloud Apps the necessary permissions to access activity logs and metadata from your Google Workspace environment. This connection is the specific mechanism required to discover and monitor OAuth applications that users have authorized, thereby enabling you to assess their permissions, usage, and potential risk. This action directly fulfills the requirement to monitor OAuth authentication requests for the Google Workspace portion of the organization's cloud presence.

B. No: This is incorrect. Connecting a supported application like Google Workspace is the standard and required procedure within Defender for Cloud Apps to gain visibility into its activities, which explicitly includes OAuth app authorizations and usage.

1. Microsoft Learn. "Connect Google Workspace to Microsoft Defender for Cloud Apps." Microsoft Docs. Accessed October 2023. In the overview section

it details the capabilities gained after connection

which includes visibility into activities and governance

the foundation for monitoring OAuth apps. The process described is exactly what the solution proposes.

2. Microsoft Learn. "Investigate and manage risky OAuth apps." Microsoft Docs. Accessed October 2023. This document states

"Defender for Cloud Apps uses the API connectors to pull a list of OAuth apps that are authorized by your users in connected apps such as Microsoft 365

Google

and Salesforce." This directly confirms that the app connector is the prerequisite for monitoring OAuth apps.

3. Microsoft Learn. "How Defender for Cloud Apps helps protect your Google Workspace environment." Microsoft Docs. Accessed October 2023. This document outlines the protection capabilities

including "Detecting threats from user and app activities

" which encompasses the monitoring of OAuth applications connected to the environment.

For an application (service principal) like App1 to authenticate itself and access another application's API like App2, it must present its own credentials. The Microsoft identity platform supports two primary types of credentials for application identities. The first is a client secret, which is a string value that acts as an application-specific password. The second, and more secure, method is a certificate. With this method, the application uses its private key to sign a JSON Web Token (JWT) assertion, which is then used to prove its identity to Microsoft Entra ID. Both methods allow the application to authenticate without any user interaction, which is typical for service-to-service communication.

B. managed identity: A managed identity is an identity for an Azure resource (e.g., a VM or App Service), not a credential type that is configured on a generic application registration itself.

D. user account: A user account is used for delegated authentication, where an application acts on behalf of a signed-in user, not for authenticating the application itself.

E. one-time password: This is a form of multi-factor authentication for user accounts and is not applicable to application service principals.

1. Microsoft Entra documentation

"Application and service principal objects in Microsoft Entra ID": Under the "Service principal authentication" section

it states: "The Microsoft identity platform supports two types of authentication for service principals: password-based authentication (client secret) and certificate-based authentication." This directly confirms that certificates and secrets are the valid credential types.

2. Microsoft identity platform documentation

"Microsoft identity platform and the OAuth 2.0 client credentials flow": This document details the protocol for service-to-service calls. In the "Get a token" section

it shows two distinct protocol requests: the first uses a clientsecret parameter

and the second uses a clientassertion parameter

which is a JWT signed by a certificate. This demonstrates the two credential mechanisms at the protocol level.

3. Microsoft Entra documentation

"Quickstart: Register an application with the Microsoft identity platform": In the "Add credentials" section

the steps guide the user to add either a "Client secret" or a "Certificate" to the application registration

reinforcing these are the two available options.

The current access review configuration in image_d03e22.png uses the Manager as the designated reviewer, with Megan Bowen defined as the fallback reviewer. Because all requests are falling back to Megan Bowen, the system is unable to determine a valid manager for the users under review (likely due to the manager attribute being unconfigured in Microsoft Entra ID for these accounts).

Creating a separate access review for each role does not address the root issue of missing manager attributes, nor does it dynamically align review routing by department. To meet the goal, you should either ensure the manager property is properly populated for all administrators or create separate access reviews targeted at specific groups or departments with their respective department heads explicitly assigned as reviewers.

A. Yes: Creating separate reviews by role does not change the reviewer routing logic or fix missing user-manager relationships, meaning requests will continue going to the fallback reviewer.

Microsoft Official Documentation: What are Microsoft Entra access reviews? & Create an access review of Azure AD roles in Privileged Identity Management (PIM). Section: "Advanced / Reviewers selection" (Specifies that if 'Manager' is chosen and a user has no manager assigned in the directory, the review falls back to the designated fallback reviewer).

The Azure AD audit logs are the definitive source for tracking administrative and policy-related events within a tenant. When a user is presented with a Terms of Use (ToU) policy and either accepts or declines it, a specific audit event is generated. These logs capture the user's identity, the timestamp of the action, and the outcome (accept or decline). By filtering the audit logs for the "UserManagement" category and activities related to "Accept terms of use policy" or "Decline terms of use policy," an administrator can accurately identify the status for each user regarding "Terms1".

A. provisioning logs: These logs track the creation, update, and deletion of users and groups, typically related to automated provisioning, not user consent actions.

B. the Usage and Insights report: This provides aggregated data and trends on application usage and sign-in activity, not granular, event-level details of ToU acceptance.

C. sign-in logs: These logs record user authentication events. While a ToU may be part of the sign-in flow, the log's primary focus is on the sign-in itself, not the specific consent action.

1. Microsoft Learn | Azure Active Directory documentation. "Monitor and report on terms of use." This document explicitly states

"The Azure AD audit logs record user activity

including consent to a terms of use policy... To view who has and has not accepted a ToU policy

in Azure Active Directory

select Terms of use. Select a terms of use policy. Under Monitor

select Accepted." The underlying data for this view is sourced from the audit logs. The document further details filtering the audit log for the "Accept terms of use policy" activity.

2. Microsoft Learn | Azure Active Directory documentation. "Audit log activities." This reference lists all activities recorded in the audit logs. Under the "User management" category

it includes "Accept terms of use policy" and "Decline terms of use policy" as specific

logged events.

3. Microsoft Learn | Azure Active Directory documentation. "What are Azure Active Directory reports?" This document describes the different types of reports. It clarifies that audit logs capture "a record of all events that occur in your tenant

" while sign-in logs capture "information about the usage of managed applications and user sign-in activities

" confirming the distinct purpose of each log.

Security defaults in Microsoft Entra ID provide a baseline level of security but are mutually exclusive with Conditional Access policies. When Security defaults are enabled, which is the standard for new tenants, all options to create and manage Conditional Access policies are unavailable (grayed out). To gain the granular control offered by Conditional Access, an administrator must first explicitly disable the tenant-wide Security defaults. This action makes the Conditional Access policy configuration interface accessible, allowing for the creation of custom access rules.

A. Disable the User consent settings: User consent settings manage application permissions and are not a prerequisite for enabling or configuring Conditional Access policies.

C. Configure a multi-factor authentication (MFA) registration policy: An MFA registration policy is typically configured using a Conditional Access policy, not before. Disabling Security defaults is the necessary first step to even create such a policy.

D. Configure password protection for Windows Server Active Directory: This is a separate identity protection feature for hybrid environments and has no direct dependency on or bearing on the ability to configure Conditional Access policies in Azure.

1. Microsoft Entra documentation

"Security defaults in Microsoft Entra ID":

Section: "Disabling security defaults"

Content: "If you want to use Conditional Access policies to replace security defaults

you must disable security defaults... Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults." This explicitly states that disabling security defaults is a required step before using Conditional Access.

2. Microsoft Entra documentation

"Conditional Access and security defaults":

Section: "Conditional Access and security defaults"

Content: "If you're a customer using security defaults

you must disable security defaults to enable Conditional Access." This confirms the mutual exclusivity and the required order of operations.

To control Multi-Factor Authentication (MFA) based on a user's physical location, such as a specific office, you must use the location condition within an Azure AD Conditional Access policy. Azure AD identifies a user's location by their source public IP address. The Named Locations feature allows you to define a trusted location, like the Boston office, by specifying its public IP address range(s). This named location can then be used in a Conditional Access policy to either require or bypass MFA for users connecting from that network, thereby meeting the specified requirements.

A. named locations that have a private IP address range: Azure AD is a cloud service and cannot see the internal private IP addresses (e.g., 10.0.0.0/8) of a corporate network; it only sees the public-facing IP.

C. trusted IPs that have a public IP address range: "Trusted IPs" is a legacy feature within the MFA service settings. While functional, the modern and recommended best practice is to use Named Locations with Conditional Access for more granular and flexible policy control.

D. trusted IPs that have a private IP address range: The legacy "Trusted IPs" feature, like Named Locations, operates on public IP addresses, as Azure AD has no visibility into an organization's internal private network ranges.

---

1. Microsoft Azure Documentation

"Use the location condition in a Conditional Access policy": This document explicitly states how to configure locations for use in Conditional Access. In the section "Configure IP address ranges location

" it clarifies

"You can mark IP address ranges that represent your organization's on-premises network in Azure AD as a named location... Private IP ranges cannot be specified." This supports using public IP ranges and directly refutes options involving private IPs.

Source: Microsoft Corporation. (2023). Use the location condition in a Conditional Access policy. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#configure-ip-address-ranges-location

2. Microsoft Azure Documentation

"Configure Azure AD Multi-Factor Authentication settings": This document describes the "Trusted IPs" feature and its limitations. It notes

"If you're using Conditional Access

trusted IPs must be configured as a named location." This confirms that for modern policy-based control

Named Locations is the correct and integrated feature to use

making it superior to the legacy "Trusted IPs" option.

Source: Microsoft Corporation. (2023). Configure Azure AD Multi-Factor Authentication settings. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips

The recommended solution is to use a Network Policy Server (NPS) with the Azure AD Multi-Factor Authentication extension. The on-premises VPN server, acting as a RADIUS client, sends authentication requests to the NPS. The NPS extension then communicates with Azure AD to enforce the user's MFA policy, providing a second factor of authentication. This architecture allows organizations to secure their existing RADIUS-based authentication infrastructure, such as VPNs, with cloud-based Azure MFA without replacing the core hardware. The primary authentication still occurs against the on-premises Active Directory.

A. Azure AD Application Proxy: This service is designed to publish on-premises web applications for secure remote access, not for integrating MFA with RADIUS clients like a VPN server.

B. an Azure AD Password Protection proxy: This component extends Azure AD's custom banned password lists and smart lockout features to an on-premises Active Directory. It does not provide MFA.

D. a pass-through authentication proxy: This is an Azure AD Connect agent that validates user passwords directly against on-premises Active Directory for sign-in. It is not a RADIUS proxy for MFA.

---

1. Microsoft Learn. "Integrate your existing Network Policy Server (NPS) infrastructure with Azure AD Multi-Factor Authentication." Microsoft Entra Documentation. This document explicitly states

"The NPS extension for Azure AD MFA adds cloud-based MFA capabilities to your on-premises infrastructure... The NPS extension acts as an adapter between RADIUS and cloud-based Azure AD MFA to provide a second factor of authentication for... users." It includes a diagram showing a VPN server as a RADIUS client connecting to an NPS server with the extension.

2. Microsoft Learn. "Plan an Azure AD Multi-Factor Authentication deployment." Microsoft Entra Documentation. In the section "Choose your authentication methods

" it details using the NPS extension for on-premises applications: "For on-premises apps that use RADIUS authentication

the best option is to deploy an NPS server with the Azure AD MFA NPS extension."

3. Microsoft Learn. "What is Application Proxy?" Microsoft Entra Documentation. This source clarifies the purpose of Application Proxy: "Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications." This confirms it is not suitable for RADIUS/VPN authentication.

4. Microsoft Learn. "Deploy on-premises Azure AD Password Protection." Microsoft Entra Documentation. This document describes the role of the proxy service as part of the Password Protection feature

which is unrelated to providing MFA for authentication requests.

The scenario describes an application that runs as a service without user interaction, often referred to as a daemon or background service. For such applications to access a protected API like Microsoft Graph, they must use application permissions. These permissions are granted directly to the application's identity (its service principal) by an administrator. The application authenticates using its own credentials (like a client secret or certificate) and receives an access token that is not associated with any user. This is the correct model for non-interactive, server-to-server scenarios.

B. delegated permissions: These are incorrect because they require a signed-in user to be present. The application would be acting on behalf of that user, and the scenario explicitly states the app runs "without user interaction."

C. a custom role-based access control (RBAC) role: This is incorrect. Microsoft Entra RBAC roles grant permissions to manage Microsoft Entra resources, but the primary mechanism for an app to be authorized for an API call is through API permissions.

D. a built-in role-based access control (RBAC) role: This is incorrect for the same reason as custom RBAC roles. While a service principal can be assigned a role, the authorization to call the Microsoft Graph API is governed by the granted API permissions.

1. Microsoft Entra ID documentation

"Permission types": "Application permissions are used by apps that run without a signed-in user present; for example

apps that run as background services or daemons. Application permissions can only be consented to by an administrator."

Source: Microsoft Learn

Permissions and consent in the Microsoft identity platform

Section: "Permission types".

2. Microsoft Graph documentation

"Permissions overview": "For scenarios without a signed-in user

the app can be granted application permissions... Application permissions are also known as app-only access. The app is authorized to call the API based on the permissions that have been granted directly to the app by an administrator."

Source: Microsoft Learn

Microsoft Graph permissions overview

Section: "Permission types".

3. Microsoft Entra ID documentation

"Microsoft identity platform and the OAuth 2.0 client credentials flow": This document details the authentication flow for service-to-service calls. "In the client credentials flow

permissions are granted directly to the application itself. When the app presents a token to a resource

the resource enforces that the app itself has authorization to perform an action since there is no user involved in the authentication."

Source: Microsoft Learn

Microsoft identity platform and the OAuth 2.0 client credentials flow

Section: "Protocol diagram".

Azure attribute-based access control (ABAC) adds conditions to role assignments to provide more fine-grained access control. Currently, conditions are supported for built-in or custom role assignments that include storage data actions, specifically for Azure Blob Storage and Azure Queue Storage.

The Storage Blob Data Reader role is a data plane role with storage data actions, making it eligible for ABAC conditions. The other roles listed—Reader, Contributor, and Virtual Machine Contributor—are Azure Resource Manager (management plane) roles and do not currently support the addition of ABAC conditions.

A. User1: The Reader role is a management plane role that grants read access to management resources and does not support ABAC conditions.

B. User2: The Contributor role is a management plane role that grants full access to manage resources but does not support ABAC conditions.

D. User4: The Virtual Machine Contributor role is a management plane role for managing virtual machines and does not support ABAC conditions.

1. Microsoft Learn. "What is Azure attribute-based access control (Azure ABAC)?". Microsoft Docs. Accessed October 2023. In the section "Where can I add conditions?"

it states

"Currently

conditions can be added to built-in or custom role assignments that have storage blob data actions or storage queue data actions." This confirms that only storage data roles support ABAC.

2. Microsoft Learn. "Prerequisites for Azure role assignment conditions". Microsoft Docs. Accessed October 2023. This document outlines the requirements for using ABAC

emphasizing its application to storage accounts and roles with storage data actions

such as Storage Blob Data Reader

Storage Blob Data Contributor

and Storage Blob Data Owner.

3. Microsoft Learn. "Actions and attributes for Azure role assignment conditions for Azure Storage". Microsoft Docs. Accessed October 2023. This page provides a comprehensive list of the attributes and data actions (e.g.

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read) that can be used in conditions

all of which are specific to Azure Storage

thereby excluding management plane roles like Reader and Contributor.

Tenant restrictions function by intercepting authentication requests to Azure AD and require client applications to use modern authentication (OAuth 2.0). Outlook 2013 does not support modern authentication by default and relies on legacy protocols. While modern authentication can be enabled for Outlook 2013 via registry modifications, the client itself is past its support lifecycle. To ensure tenant restrictions work reliably and to align with security best practices, the required first step is to upgrade the non-compliant clients to a version that natively supports modern authentication, such as Outlook 2016. This addresses the prerequisite compatibility issue directly.

B. Configuring Outlook 2013 for modern authentication is a temporary fix on an unsupported client, which is not a reliable long-term solution for a modern security feature.

C. Upgrading all clients, including the already-compliant Outlook 2016 clients, creates more administrative effort than necessary, violating the stated requirement.

D. Organization Sharing is an Exchange feature for sharing calendar information between tenants and is unrelated to Azure AD tenant restrictions, which control application sign-ins.

1. Microsoft Learn. How modern authentication works for Office 2013

Office 2016

Office 2019

and Microsoft 365 Apps. "Modern authentication is not enabled by default in Office 2013. You must enable it... Modern authentication is enabled by default in... Office 2016." This document establishes the fundamental difference in the clients mentioned in the scenario.

2. Microsoft Learn. Use tenant restrictions to manage access to SaaS cloud applications. Under the "How it works" section

it states

"The solution is for applications that use modern authentication... For applications that use legacy authentication

these protections do not work." This confirms that modern authentication is a mandatory prerequisite for tenant restrictions to be effective.

3. Microsoft Learn. Office 2013 - Microsoft Lifecycle. This document confirms that extended support for Office 2013 ended on April 11

2023. Implementing new security controls on unsupported software is not a recommended practice

making an upgrade the appropriate first step.

The scenario requires a multi-factor authentication (MFA) method that functions when a user's laptop has wired internet, but their mobile phone has no connectivity (neither Wi-Fi nor cellular). Windows Hello for Business is the only suitable option. It satisfies MFA requirements by combining something the user has (the physical laptop with a securely stored cryptographic key) with something the user knows (a PIN) or something the user is (a biometric gesture). This authentication process occurs on the laptop and uses its internet connection to communicate with Azure AD, making it independent of any mobile phone connectivity.

A. a notification through the Microsoft Authenticator app: This method requires the mobile phone to have an active internet connection (Wi-Fi or cellular data) to receive the push notification, which is unavailable.

B. an app password: App passwords are a legacy workaround for older applications that do not support modern authentication and cannot prompt for MFA; they are not a primary MFA method for interactive user sign-ins.

D. SMS: This method relies on the user receiving a text message, which requires cellular network connectivity on the mobile phone. The scenario explicitly states this is not available.

1. Windows Hello for Business: Microsoft Learn

How Windows Hello for Business works - Authentication. This document explains

"Windows Hello for Business is a strong two-factor credential that people can use to sign in to their Windows device... The two factors are something you have (your device with its TPM) and something you know (your PIN) or something you are (your biometric)." This confirms it is a valid MFA method that is self-contained on the device.

2. Authenticator App Notifications: Microsoft Learn

How to use the Microsoft Authenticator app. In the section "Respond to a sign-in notification

" the prerequisite is clear: "If you enabled push notifications... your phone must be connected to the internet." This directly contradicts the scenario's constraints.

3. SMS Authentication: Microsoft Learn

Authentication methods in Azure Active Directory - SMS. The "How it works" section details that "a text message containing a verification code is sent to the mobile phone number." This process is impossible without cellular service.

4. App Passwords: Microsoft Learn

Manage app passwords for two-step verification. This page states

"App passwords are for apps that don't support modern authentication... If you have multi-factor authentication set up for your organization

you should try to use modern authentication." This positions app passwords as a fallback for legacy apps

not a primary MFA method for a user's main sign-in.

HighRiskCountries: In Microsoft Entra Conditional Access, named locations (which can contain a list of IP address ranges or specific countries/regions) are referenced under the Locations setting. The locations setting is categorized under the policy's Conditions assignment block.

Sign-in frequency: To restrict the time duration for which a user can remain authenticated before being prompted to sign in again, you must manage the session lifetime. This configuration is done via Sign-in frequency, which is explicitly categorized as A session control under the Access Controls section of the policy.

Microsoft Entra ID Official Vendor Documentation: How to Use Conditions in Conditional Access Policies (Section: "Network location" / "Locations" condition).

Microsoft Entra ID Official Vendor Documentation: Conditional Access adaptive session lifetime policies (Section: "User sign-in frequency" under Session controls).

Number of days: When a user is deleted from Microsoft Entra ID (Azure AD), the account enters a "soft-deleted" or suspended state for 30 days. During this window, the account and its associated properties can be fully recovered. Once this period expires, the object is permanently deleted and becomes unrecoverable.

Role: The User administrator is the least privileged built-in identity role that can manage all aspects of user accounts, including deleting and restoring soft-deleted directory user objects. Other listed roles, such as Helpdesk administrator, are constrained to tasks like password resets and service health checks but lack authority to restore deleted accounts.

Microsoft Learn — Recover deleted data - Microsoft Entra PowerShell Section: "Step 2: Restore soft-deleted users" — Specifies that accounts remain in a suspended state for 30 days, after which they are permanently deleted.Microsoft Learn — Restore a user - Microsoft 365 admin Section: "Restore one or more user accounts" — Verifies the 30-day recovery policy and notes that you must be a User Administrator to perform the action.Microsoft Learn — About administrator roles in the Microsoft 365 admin center Section: "User Administrator" and "Helpdesk Administrator" — Delineates the task constraints between different administrative roles.Microsoft Learn — Restore-EntraDeletedDirectoryObject (Microsoft.Entra.DirectoryManagement) Section: "Description" — Confirms delegated permissions require the User Administrator role to restore deleted user objects.

The requirement states that "The helpdesk administrators must be able to manage licenses for only the users in their respective office."

To restrict administrative privileges (such as license management) to a specific subset of users within a tenant, you must use Administrative Units (AUs). Creating an administrative unit for each branch office allows you to scope the helpdesk administrators' roles (like the License Administrator or Helpdesk Administrator role) specifically to the users within that branch office.

The Azure Active Directory admin center (or Microsoft Entra admin center) is the primary tool used to create administrative units, manage their membership, and assign scoped administrative roles to users.

Microsoft Entra ID / Azure AD Documentation: Section on "Designate administrative units for scoped role delegation" and "Assign Azure AD roles with administrative unit scope".

Exam SC-300 / MS-102 Case Studies: Technical requirements for identity management and administrative scoping using AUs.

First Dropdown (Authentication methods): To satisfy the requirement that users must be prompted to respond to a mobile app notification or answer three predefined security questions, you must configure the Authentication methods section under the Password reset blade. This section allows administrators to specify the number of methods required to reset a password and choose which specific options (such as mobile app notification or security questions) are available to users.

Second Dropdown (Password writeback): Azure AD Connect Express Settings already configures Password Hash Synchronization (PHS), which synchronizes passwords from the on-premises Active Directory domain to Microsoft Entra ID (Azure AD). To ensure passwords are synchronized regardless of where the password was reset (specifically allowing cloud-initiated resets via SSPR to sync back to the on-premises environment), you must enable Password writeback within Azure AD Connect.

Microsoft Learn Documentation: Browse authentication methods for self-service password reset (SSPR)

Section: "Available authentication methods"

Detail: Outlines how to configure specific authentication gates—including security questions and mobile app notifications—within the Authentication methods menu of the SSPR configuration blade.

Microsoft Learn Documentation: Tutorial: Enable Microsoft Entra self-service password reset writeback to an on-premises environment

Section: "Enable password writeback option in Azure AD Connect"

Detail: Explains that password writeback is an asynchronous feature enabled in Azure AD Connect that writes cloud-based password resets back to an on-premises directory in real-time.

Statement 1 (Yes): Secret1 was deleted from KeyVault2 on June 1. KeyVault2 has a retention period of 10 days, meaning the secret remains in a recoverable soft-deleted state until June 11. Admin1 is assigned the Key Vault Administrator role, which is a data-plane role that grants full permission to perform all key, secret, and certificate operations, including recovery (Microsoft.KeyVault/vaults/secrets/recover/action). Therefore, Admin1 can successfully recover it on June 7.

Statement 2 (No): Certificate1 is located in KeyVault1, which has Purge protection enabled. When purge protection is enabled, no user—regardless of their assigned role or permissions—can manually purge a deleted object until the mandatory retention period has fully expired.

Statement 3 (No): Certificate1 was deleted on June 1 and has a 15-day retention period, meaning the retention period expires on June 16. Because purge protection is enabled on KeyVault1, the certificate cannot be purged by anyone on June 14, as this date falls within the mandatory 15-day retention window. Furthermore, after June 16, Azure Key Vault will automatically purge the item; manual intervention is restricted.

Microsoft Learn: Azure Key Vault soft-delete overview. "Purge protection: When purge protection is on, a vault or an object in the deleted state cannot be purged until the retention period has passed. Soft-deleted vaults and objects can still be recovered, ensuring that the retention policy will be followed."

Source: https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection

Microsoft Learn: Azure built-in roles for Key Vault data plane operations. Details the permissions of the Key Vault Administrator role, explicitly listing the recovery actions permitted during the soft-delete retention window.

Source: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-administrator

The solution requires two key actions. First, a special type of group, known as a "role-assignable group," must be created. This is achieved by setting the "Azure AD roles can be assigned to the group" property to "Yes" during group creation. Only role-assignable groups can be assigned Azure AD roles.

Second, to allow members to activate the role, the group must be given an "Eligible" assignment for the Security Reader role within Azure AD Privileged Identity Management (PIM). An eligible assignment means that members of the group do not have the role permissions by default but can elevate their privileges to activate the role when needed.

1. Microsoft Learn Documentation

"Create a role-assignable group in Azure Active Directory." This document explicitly details the process of creating a group that can be assigned an Azure AD role.

Reference: Under the section "Create a role-assignable group

" Step 5 states: "For Azure AD roles can be assigned to the group

select Yes." This confirms the critical setting for the group creation.

Source: https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-create-rule

2. Microsoft Learn Documentation

"Assign Azure AD roles in Privileged Identity Management." This guide explains how to assign roles to principals (including groups) using PIM and clarifies the difference between "Eligible" and "Active" assignments.

Reference: Under the section "Assign a role

" the steps outline selecting a role

adding an assignment

and choosing the assignment type. The description for "Eligible" assignment type states

"Eligible assignments require the member to perform an action to use the role." This directly corresponds to the question's requirement that members "can activate" the role.

Source: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user

3. Microsoft Learn Documentation

"Use Azure AD groups to manage role assignments." This document provides the conceptual background for using groups to manage roles.

Reference: In the "Overview" section

it states: "To assign a role to a group

it must be created with the isAssignableToRole property set to true. In the Azure portal

you set the Azure AD roles can be assigned to the group option to Yes." This reinforces the prerequisite for the group's configuration.

Source: https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept

File1 (Blob Container): Azure role-based access control (RBAC) separates management (control plane) and data (data plane) operations. User2 is explicitly assigned the Storage Blob Data Reader role, which provides data plane access to read blob contents. User3 is assigned the Storage Contributor role; while this is a management role that does not directly grant Entra ID data access, it contains the Microsoft.Storage/storageAccounts/listkeys/action permission. This allows User3 to retrieve the storage account access keys and use them to read the blob data. User1 holds only the Reader role, which permits viewing the resource but denies both data access and key retrieval.

File2 (File Share): To read files within an Azure File share via standard management interfaces (like the Azure Portal), a user must authenticate using the storage account access keys. User3's Storage Contributor role allows them to retrieve these keys, granting access to File2. Neither User1 (Reader) nor User2 (Storage Blob Data Reader) possess permissions to list the storage account keys or read file share data, making them unable to access File2.

Azure built-in roles - Storage Contributor: Official documentation detailing that the Storage Contributor role grants full management access, including the ability to list access keys (Microsoft.Storage/storageAccounts/listkeys/action).

Link: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-contributor

Azure built-in roles - Storage Blob Data Reader: Official documentation detailing the specific DataActions granted, specifically Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read, which allows reading blob content.

Link: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-reader

Authorize access to data in Azure Storage: Official architectural overview explaining how control plane permissions (access keys) and data plane permissions (Azure AD RBAC) are evaluated independently for data access.

Link: https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-aad

Can expire: Microsoft Entra ID (formerly Azure AD) group expiration policies are exclusively supported for Microsoft 365 groups. Expiration lifecycle policies cannot be applied to Security groups, Mail-enabled security groups, or Distribution lists. In the provided scenario, Group2 is the only Microsoft 365 group, making it the only valid selection for expiration configuration.

Shortest lifetime: When configuring the expiration policy in the Entra ID admin center, administrators can set the group lifetime using preset values (such as 180 or 365 days) or by defining a custom value in days. Official Microsoft specifications strictly require that any custom expiration lifetime value must be at least 30 days.

Microsoft Learn - Microsoft Entra ID Documentation: "Configure the expiration policy for Microsoft 365 groups"

Section Reference: Under the "Set group expiration" section, the documentation explicitly states: "You can select one of the preset values or a custom value. It should be 30 days or more."

Section Reference: The documentation also clarifies the operational scope under the same section: "Select which Microsoft 365 groups expire," confirming this feature does not extend to traditional security or distribution groups.

Microsoft Learn - Microsoft 365 Solutions: "Microsoft 365 group expiration policy"

Section Reference: Under "How to set the expiration policy," it reiterates the minimum threshold: "The custom value has to be at least 30 days."