Pass Your Microsoft AB-900 Exam Easy!

Consent inventory reveals existing delegated and app-only authorization. That addresses review of existing app API privileges, whereas the current case requires unattended API access with no user.

Delegated permissions operate within the signed-in user's effective rights. It is used for per-user constrained API access; this scenario calls for unattended API access with no user.

Admin consent governs permissions that exceed user grant rights. It is used for elevated consent for high-impact API scopes; this scenario calls for unattended API access with no user.

Authentication strength constrains eligible methods beyond generic MFA. Its purpose is stronger phishing-resistant sign-in methods; the specified need is hybrid device-trust gated access.

Risk-based block access prevents a session rather than permitting a second-factor bypass. It would support risk-triggered denial, not the stated hybrid device-trust gated access.

The grant relies on evaluated management compliance state. Its purpose is access only from policy-compliant endpoints; the specified need is hybrid device-trust gated access.

Access packages automate approved and time-limited resource assignment. The action is relevant to request-based temporary bundle access rather than curated manually approved group access.

PIM reduces standing role access through controlled activation. This helps with temporary high-privilege access instead of the required curated manually approved group access.

Dynamic groups evaluate member properties without manual updates. The action is relevant to attribute-driven group population rather than curated manually approved group access.

Temporary Access Pass supports bootstrapping and recovery of strong authentication. It is used for first-time credential bootstrap; this scenario calls for scoped passkey eligibility.

Removing obsolete method registration enables controlled credential recovery. It is used for safe replacement of an authentication device; this scenario calls for scoped passkey eligibility.

Method inventory reports which factors are enrolled. That addresses current factor enrollment evidence, whereas the current case requires scoped passkey eligibility.

Session revocation prevents continued reuse of outstanding authentication sessions. It would support termination of active compromised sign-ins, not the stated troubleshooting one anomalous authentication.

User risk evaluates the likelihood of a compromised identity. Its purpose is response to account-level compromise; the specified need is troubleshooting one anomalous authentication.

Risk remediation records resolution after recovery action. Its purpose is clearing a verified recovered user-risk case; the specified need is troubleshooting one anomalous authentication.

Provisioning logs report account synchronization and processing outcomes. The action is relevant to app identity provisioning diagnostics rather than attribution of directory updates.

Authentication and administrative activity are separate but complementary evidence streams. This helps with end-to-end identity incident timeline instead of the required attribution of directory updates.

Sign-in records capture authentication results and policy enforcement. The action is relevant to per-attempt sign-in investigation rather than attribution of directory updates.

Real sign-in logs record policies and grants evaluated at that event. It is used for diagnosis of actual conditional access denial; this scenario calls for prospective policy applicability for one scenario.

Emergency exclusions prevent tenant-wide lockout while retaining audit oversight. That addresses controlled emergency account resilience, whereas the current case requires prospective policy applicability for one scenario.

Report-only calculates hypothetical results without enforcing denial. It is used for safe initial assessment of policy impact; this scenario calls for prospective policy applicability for one scenario.

Access reviews enable accountable periodic entitlement recertification. Its purpose is periodic membership review; the specified need is delegated temporary external onboarding.

Lifecycle workflows automate identity-related events and task sequences. Its purpose is automated workforce identity transitions; the specified need is delegated temporary external onboarding.

PIM implements controlled time-limited privilege. It would support just-in-time privileged administration, not the stated delegated temporary external onboarding.

Adoption metrics track product use, not security or compliance framework scores. This helps with Copilot adoption measurement instead of the required identity-only configuration improvements.

Secure Score aggregates security recommendations across Microsoft security controls. The action is relevant to broad cloud security posture recommendations rather than identity-only configuration improvements.

Compliance Manager organizes control assessments and improvement actions. The action is relevant to formal compliance control improvement rather than identity-only configuration improvements.

Tenant collaboration policies govern permitted partner organizations. It is used for partner domain allow/deny governance; this scenario calls for cross-tenant Teams shared-channel participation.

Review-based cleanup reduces persistence of abandoned partner access. That addresses expired external collaboration rights, whereas the current case requires cross-tenant Teams shared-channel participation.

B2B collaboration grants scoped resource access to external identities. It is used for ordinary external guest collaboration; this scenario calls for cross-tenant Teams shared-channel participation.

TAP is designed for controlled bootstrap and account recovery. Its purpose is initial credential enrollment; the specified need is device-bound passwordless Windows sign-in.

Authenticator approvals add an interactive possession-based sign-in step. It would support mobile authenticator challenge, not the stated device-bound passwordless Windows sign-in.

FIDO2 authenticator assertions resist phishing and can be portable. Its purpose is external roaming security-key sign-in; the specified need is device-bound passwordless Windows sign-in.