Pass Your Microsoft AB-900 Exam Easy!

Enterprise apps represent tenant-local service principals and user assignments. Its purpose is tenant access to deployed SaaS app; the specified need is developer-side application identity definition.

Managed identities provision service identity tokens without customer-managed credentials. It would support passwordless Azure workload identity, not the stated developer-side application identity definition.

Tenant-level application grants require privileged review and scope controls. Its purpose is governance of application-level API access; the specified need is developer-side application identity definition.

Consent inventory reveals existing delegated and app-only authorization. The action is relevant to review of existing app API privileges rather than per-user constrained API access.

Application permissions support app-only access independent of a user session. The action is relevant to unattended API access with no user rather than per-user constrained API access.

Admin consent governs permissions that exceed user grant rights. This helps with elevated consent for high-impact API scopes instead of the required per-user constrained API access.

Authentication strength constrains eligible methods beyond generic MFA. That addresses stronger phishing-resistant sign-in methods, whereas the current case requires access only from policy-compliant endpoints.

Risk-based block access prevents a session rather than permitting a second-factor bypass. It is used for risk-triggered denial; this scenario calls for access only from policy-compliant endpoints.

Hybrid-join grant conditions assess the required device trust. It is used for hybrid device-trust gated access; this scenario calls for access only from policy-compliant endpoints.

Assigned groups allow direct intentional membership control. Its purpose is curated manually approved group access; the specified need is attribute-driven group population.

Access packages automate approved and time-limited resource assignment. It would support request-based temporary bundle access, not the stated attribute-driven group population.

PIM reduces standing role access through controlled activation. Its purpose is temporary high-privilege access; the specified need is attribute-driven group population.

Method policies control allowed registration and use of methods. The action is relevant to scoped passkey eligibility rather than first-time credential bootstrap.

Removing obsolete method registration enables controlled credential recovery. This helps with safe replacement of an authentication device instead of the required first-time credential bootstrap.

Method inventory reports which factors are enrolled. The action is relevant to current factor enrollment evidence rather than first-time credential bootstrap.

Session revocation prevents continued reuse of outstanding authentication sessions. It is used for termination of active compromised sign-ins; this scenario calls for response to account-level compromise.

Sign-in risk reports assess one authentication event. It is used for troubleshooting one anomalous authentication; this scenario calls for response to account-level compromise.

Risk remediation records resolution after recovery action. That addresses clearing a verified recovered user-risk case, whereas the current case requires response to account-level compromise.

Provisioning logs report account synchronization and processing outcomes. It would support app identity provisioning diagnostics, not the stated per-attempt sign-in investigation.

Authentication and administrative activity are separate but complementary evidence streams. Its purpose is end-to-end identity incident timeline; the specified need is per-attempt sign-in investigation.

Audit events record administrative directory object changes. Its purpose is attribution of directory updates; the specified need is per-attempt sign-in investigation.

What If evaluates policy applicability under selected inputs. The action is relevant to prospective policy applicability for one scenario rather than safe initial assessment of policy impact.

Real sign-in logs record policies and grants evaluated at that event. This helps with diagnosis of actual conditional access denial instead of the required safe initial assessment of policy impact.

Emergency exclusions prevent tenant-wide lockout while retaining audit oversight. The action is relevant to controlled emergency account resilience rather than safe initial assessment of policy impact.

Entitlement packages bundle resource access and request policies. It is used for delegated temporary external onboarding; this scenario calls for periodic membership review.

Lifecycle workflows automate identity-related events and task sequences. That addresses automated workforce identity transitions, whereas the current case requires periodic membership review.

PIM implements controlled time-limited privilege. It is used for just-in-time privileged administration; this scenario calls for periodic membership review.

Adoption metrics track product use, not security or compliance framework scores. Its purpose is Copilot adoption measurement; the specified need is broad cloud security posture recommendations.

Identity Secure Score focuses identity-specific hardening measurements. Its purpose is identity-only configuration improvements; the specified need is broad cloud security posture recommendations.

Compliance Manager organizes control assessments and improvement actions. It would support formal compliance control improvement, not the stated broad cloud security posture recommendations.

Tenant collaboration policies govern permitted partner organizations. This helps with partner domain allow/deny governance instead of the required ordinary external guest collaboration.

Review-based cleanup reduces persistence of abandoned partner access. The action is relevant to expired external collaboration rights rather than ordinary external guest collaboration.

Direct connect supports certain cross-organization shared-channel experiences. The action is relevant to cross-tenant Teams shared-channel participation rather than ordinary external guest collaboration.