Pass Your Microsoft AB-900 Exam Easy!

TAP is designed for controlled bootstrap and account recovery. Its purpose is initial credential enrollment; the specified need is device-bound passwordless Windows sign-in.

Authenticator approvals add an interactive possession-based sign-in step. It would support mobile authenticator challenge, not the stated device-bound passwordless Windows sign-in.

FIDO2 authenticator assertions resist phishing and can be portable. Its purpose is external roaming security-key sign-in; the specified need is device-bound passwordless Windows sign-in.

App registration defines the OAuth/OIDC client identity. The action is relevant to initial app integration configuration rather than targeted enterprise application usage.

Delegated scopes act under user identity and permissions. The action is relevant to per-user API authorization rather than targeted enterprise application usage.

App-only grants permit background operations within authorized scope. This helps with unattended app API execution instead of the required targeted enterprise application usage.

Eligibility indicates potential activation; active state indicates current authority. That addresses accurate temporary privilege state, whereas the current case requires trusted office network classification.

Directory membership can trigger license assignment and removal. It is used for lifecycle-based license provisioning; this scenario calls for trusted office network classification.

Authentication method policy governs permitted method populations. It is used for targeted stronger authentication enrollment; this scenario calls for trusted office network classification.

Guest access allows limited collaboration while retaining external identity origin. Its purpose is access for a named external partner; the specified need is tenant-scoped enterprise application identity.

Group membership enables reusable access targeting. Its purpose is cohort-based application authorization; the specified need is tenant-scoped enterprise application identity.

Member identities represent primary internal workforce accounts. It would support an internal organization identity, not the stated tenant-scoped enterprise application identity.

App selection determines which resource sign-ins are evaluated. This helps with scope of a particular protected app instead of the required explicit access denial from restricted locations.

Grant controls define conditions that a sign-in must satisfy. The action is relevant to required additional authentication for selected users rather than explicit access denial from restricted locations.

Report-only evaluations record prospective outcomes without enforcement. The action is relevant to safe policy impact analysis rather than explicit access denial from restricted locations.

Identity Secure Score emphasizes identity control maturity and opportunities. It is used for identity-wide recommended hardening actions; this scenario calls for author and time of policy change.

Sign-in logs show application, error code and Conditional Access outcome. That addresses failed sign-in evidence, whereas the current case requires author and time of policy change.

User-risk signals assess possible identity compromise. It is used for aggregated account compromise risk; this scenario calls for author and time of policy change.

Seamless SSO uses existing authenticated context where protocols and policies allow. Its purpose is reduced repeated prompts in managed sessions; the specified need is legacy password-oriented app access.

SAML exchanges signed assertions for federated application authentication. It would support standards-based SAML sign-in, not the stated legacy password-oriented app access.

OIDC adds identity tokens over an OAuth-based authorization flow. Its purpose is OIDC identity federation; the specified need is legacy password-oriented app access.

Approval gates enforce oversight on privileged activation. The action is relevant to independently approved privilege activation rather than upcoming privileged entitlement expiry.

Privileged activity logs attribute activation decisions and timestamps. The action is relevant to accountable temporary role usage rather than upcoming privileged entitlement expiry.

PIM eligibility separates standing rights from temporary activated privileges. This helps with just-in-time role elevation instead of the required upcoming privileged entitlement expiry.

Registration stores the application's identity configuration and API permission declaration. That addresses developer-side application identity definition, whereas the current case requires passwordless Azure workload identity.

Enterprise apps represent tenant-local service principals and user assignments. It is used for tenant access to deployed SaaS app; this scenario calls for passwordless Azure workload identity.

Tenant-level application grants require privileged review and scope controls. It is used for governance of application-level API access; this scenario calls for passwordless Azure workload identity.

Consent inventory reveals existing delegated and app-only authorization. Its purpose is review of existing app API privileges; the specified need is elevated consent for high-impact API scopes.

Delegated permissions operate within the signed-in user's effective rights. It would support per-user constrained API access, not the stated elevated consent for high-impact API scopes.

Application permissions support app-only access independent of a user session. Its purpose is unattended API access with no user; the specified need is elevated consent for high-impact API scopes.

Risk-based block access prevents a session rather than permitting a second-factor bypass. The action is relevant to risk-triggered denial rather than stronger phishing-resistant sign-in methods.

The grant relies on evaluated management compliance state. This helps with access only from policy-compliant endpoints instead of the required stronger phishing-resistant sign-in methods.

Hybrid-join grant conditions assess the required device trust. The action is relevant to hybrid device-trust gated access rather than stronger phishing-resistant sign-in methods.