Pass Your Microsoft AB-900 Exam Easy!

Tenant collaboration policies govern permitted partner organizations. This helps with partner domain allow/deny governance instead of the required ordinary external guest collaboration.

Review-based cleanup reduces persistence of abandoned partner access. The action is relevant to expired external collaboration rights rather than ordinary external guest collaboration.

Direct connect supports certain cross-organization shared-channel experiences. The action is relevant to cross-tenant Teams shared-channel participation rather than ordinary external guest collaboration.

Windows Hello protects asymmetric credentials with a device-local user gesture. It is used for device-bound passwordless Windows sign-in; this scenario calls for external roaming security-key sign-in.

TAP is designed for controlled bootstrap and account recovery. That addresses initial credential enrollment, whereas the current case requires external roaming security-key sign-in.

Authenticator approvals add an interactive possession-based sign-in step. It is used for mobile authenticator challenge; this scenario calls for external roaming security-key sign-in.

Enterprise app assignments govern permitted organizational access. Its purpose is targeted enterprise application usage; the specified need is initial app integration configuration.

Delegated scopes act under user identity and permissions. It would support per-user API authorization, not the stated initial app integration configuration.

App-only grants permit background operations within authorized scope. Its purpose is unattended app API execution; the specified need is initial app integration configuration.

Eligibility indicates potential activation; active state indicates current authority. The action is relevant to accurate temporary privilege state rather than lifecycle-based license provisioning.

Named locations provide reusable network context for sign-in conditions. The action is relevant to trusted office network classification rather than lifecycle-based license provisioning.

Authentication method policy governs permitted method populations. This helps with targeted stronger authentication enrollment instead of the required lifecycle-based license provisioning.

The service principal represents an application instance in the directory. It is used for tenant-scoped enterprise application identity; this scenario calls for access for a named external partner.

Group membership enables reusable access targeting. That addresses cohort-based application authorization, whereas the current case requires access for a named external partner.

Member identities represent primary internal workforce accounts. It is used for an internal organization identity; this scenario calls for access for a named external partner.

App selection determines which resource sign-ins are evaluated. Its purpose is scope of a particular protected app; the specified need is required additional authentication for selected users.

Network conditions and block decisions enforce location restrictions. Its purpose is explicit access denial from restricted locations; the specified need is required additional authentication for selected users.

Report-only evaluations record prospective outcomes without enforcement. It would support safe policy impact analysis, not the stated required additional authentication for selected users.

Identity Secure Score emphasizes identity control maturity and opportunities. This helps with identity-wide recommended hardening actions instead of the required aggregated account compromise risk.

Sign-in logs show application, error code and Conditional Access outcome. The action is relevant to failed sign-in evidence rather than aggregated account compromise risk.

Directory audit events attribute administrative changes. The action is relevant to author and time of policy change rather than aggregated account compromise risk.

Password-based SSO can store and supply credentials for incompatible legacy apps. It is used for legacy password-oriented app access; this scenario calls for OIDC identity federation.

Seamless SSO uses existing authenticated context where protocols and policies allow. That addresses reduced repeated prompts in managed sessions, whereas the current case requires OIDC identity federation.

SAML exchanges signed assertions for federated application authentication. It is used for standards-based SAML sign-in; this scenario calls for OIDC identity federation.

PIM reports expose eligible and active role assignment lifetimes. Its purpose is upcoming privileged entitlement expiry; the specified need is independently approved privilege activation.

Privileged activity logs attribute activation decisions and timestamps. It would support accountable temporary role usage, not the stated independently approved privilege activation.

PIM eligibility separates standing rights from temporary activated privileges. Its purpose is just-in-time role elevation; the specified need is independently approved privilege activation.

Registration stores the application's identity configuration and API permission declaration. The action is relevant to developer-side application identity definition rather than tenant access to deployed SaaS app.

Managed identities provision service identity tokens without customer-managed credentials. The action is relevant to passwordless Azure workload identity rather than tenant access to deployed SaaS app.

Tenant-level application grants require privileged review and scope controls. This helps with governance of application-level API access instead of the required tenant access to deployed SaaS app.

Consent inventory reveals existing delegated and app-only authorization. That addresses review of existing app API privileges, whereas the current case requires unattended API access with no user.

Delegated permissions operate within the signed-in user's effective rights. It is used for per-user constrained API access; this scenario calls for unattended API access with no user.

Admin consent governs permissions that exceed user grant rights. It is used for elevated consent for high-impact API scopes; this scenario calls for unattended API access with no user.