Exam MS-102 topic 1 question 145 discussion

Correct answers: 1: -User1 only - Global Administrator 2: -User1 & User2 - Global Administrator + Guest Inviter

1. Correct. 2. All users https://www.examtopics.com/discussions/microsoft/view/50897-exam-ms-100-topic-3-question-79-discussion/

Security Administrator can modify password protection policy: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#security-administrator Guest Inviter has read permissions and "microsoft.directory/users/inviteGuest" BUT NOT "microsoft.directory/users/create", you need to be able to create a user to choose if it will be a member or guest like User Administrator can do: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#guest-inviter Password administrator role can ONLY reset password on Entra ID "microsoft.directory/users/password/update" https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#password-administrator Answers - Modify the password protection policy: User1 (Global Administrator) and User2 (Security Administrator) only - Create new guest users in Azure AD (Entra ID): User1 only

To modify the password protection policy you need Authentication Policy Administrator role. That is not available here, so here it's USER1, Global Administrator. To CREATE (not invite) guest users in this excercise, it's Global administrator and Guest Inviter roles that apply. So User 1 and User 2.

1- User 1 and User 2 2- User 1 and User 2 Question is about CREATE guest users, not INVITE guest users.

Inviting guest through B2B is different than inviting or creating guest to AZURE AD or ENTRA. A role that allows you to create users in your tenant directory, such as at least a Guest Inviter role or a User Administrator. Create a guest, admin will be manually created with the required actions. Question specifically asked for “Create guest user in Azure AD”, so as per the scenario User1 (Global Admin) and User2 (Security Admin with guest inviter role is the correct answer So, the conclusion is Box1: User1 and User2 Box2: User1 and User2

the question is create a guest not invite a guest!! there is a difference between them, invite a guest by using B2B, and the guest will receive an invitation. Create a guest admin will be manually created with the required actions

This is the second time this question has come up. And both times the wrong answer. If the external collaboration settings are default then All Users can invite guest users.

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#security-administrator User 1 and User 2 because Global and Security admin can modify password protection. All Users can invite Guest (default)

Wait wait wait... https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-guest-users?view=o365-worldwide Before you begin: You must be a global administrator to perform this task. So 1: User1 and User2 2. User1

1. User1 & User2(Tested)

Both box: 1&2 answers should be User 1, user 2 and user 4 because user 3 has no role and shouldn't be included as an administrative role.( Global administrator, security administrator and password administrator could modify password protection policy as well as create new guest users)

I think this is word play.. All users can invite a guest user. All users can not create a guest user

Invite Guest users: "External collaboration settings have default configuration." the table states "Invite Guest Users" https://learn.microsoft.com/en-us/entra/fundamentals/users-default-permissions?context=%2Fazure%2Factive-directory%2Froles%2Fcontext%2Fugr-context#compare-member-and-guest-default-permissions So answer should be: Users 1, 2 3,4

2. am thinking Users 1, 2 and 4 as 3 has no roles. A role that allows you to create users in your tenant directory, such as the Global Administrator role or a limited administrator directory role such as Guest Inviter or User Administrator. https://learn.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal

Also the Security Administrator can "Configure custom banned password list or on-premises password protection." https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-administrator And yes with tenant default everyone can invite guests. 1. User 1 and User 2 2. All users

Try in my lab tenant, Standard user (not assigned rol) to be able to create a Guest user.