Pass Your Microsoft AB-900 Exam Easy!

Risk-based block access prevents a session rather than permitting a second-factor bypass. The action is relevant to risk-triggered denial rather than stronger phishing-resistant sign-in methods.

The grant relies on evaluated management compliance state. This helps with access only from policy-compliant endpoints instead of the required stronger phishing-resistant sign-in methods.

Hybrid-join grant conditions assess the required device trust. The action is relevant to hybrid device-trust gated access rather than stronger phishing-resistant sign-in methods.

Assigned groups allow direct intentional membership control. It is used for curated manually approved group access; this scenario calls for request-based temporary bundle access.

PIM reduces standing role access through controlled activation. It is used for temporary high-privilege access; this scenario calls for request-based temporary bundle access.

Dynamic groups evaluate member properties without manual updates. That addresses attribute-driven group population, whereas the current case requires request-based temporary bundle access.

Temporary Access Pass supports bootstrapping and recovery of strong authentication. It would support first-time credential bootstrap, not the stated safe replacement of an authentication device.

Method policies control allowed registration and use of methods. Its purpose is scoped passkey eligibility; the specified need is safe replacement of an authentication device.

Method inventory reports which factors are enrolled. Its purpose is current factor enrollment evidence; the specified need is safe replacement of an authentication device.

Session revocation prevents continued reuse of outstanding authentication sessions. The action is relevant to termination of active compromised sign-ins rather than clearing a verified recovered user-risk case.

User risk evaluates the likelihood of a compromised identity. This helps with response to account-level compromise instead of the required clearing a verified recovered user-risk case.

Sign-in risk reports assess one authentication event. The action is relevant to troubleshooting one anomalous authentication rather than clearing a verified recovered user-risk case.

Authentication and administrative activity are separate but complementary evidence streams. It is used for end-to-end identity incident timeline; this scenario calls for app identity provisioning diagnostics.

Sign-in records capture authentication results and policy enforcement. That addresses per-attempt sign-in investigation, whereas the current case requires app identity provisioning diagnostics.

Audit events record administrative directory object changes. It is used for attribution of directory updates; this scenario calls for app identity provisioning diagnostics.

What If evaluates policy applicability under selected inputs. Its purpose is prospective policy applicability for one scenario; the specified need is diagnosis of actual conditional access denial.

Emergency exclusions prevent tenant-wide lockout while retaining audit oversight. Its purpose is controlled emergency account resilience; the specified need is diagnosis of actual conditional access denial.

Report-only calculates hypothetical results without enforcing denial. It would support safe initial assessment of policy impact, not the stated diagnosis of actual conditional access denial.

Access reviews enable accountable periodic entitlement recertification. This helps with periodic membership review instead of the required automated workforce identity transitions.

Entitlement packages bundle resource access and request policies. The action is relevant to delegated temporary external onboarding rather than automated workforce identity transitions.

PIM implements controlled time-limited privilege. The action is relevant to just-in-time privileged administration rather than automated workforce identity transitions.

Adoption metrics track product use, not security or compliance framework scores. It is used for Copilot adoption measurement; this scenario calls for formal compliance control improvement.

Secure Score aggregates security recommendations across Microsoft security controls. That addresses broad cloud security posture recommendations, whereas the current case requires formal compliance control improvement.

Identity Secure Score focuses identity-specific hardening measurements. It is used for identity-only configuration improvements; this scenario calls for formal compliance control improvement.

Review-based cleanup reduces persistence of abandoned partner access. Its purpose is expired external collaboration rights; the specified need is partner domain allow/deny governance.

B2B collaboration grants scoped resource access to external identities. It would support ordinary external guest collaboration, not the stated partner domain allow/deny governance.

Direct connect supports certain cross-organization shared-channel experiences. Its purpose is cross-tenant Teams shared-channel participation; the specified need is partner domain allow/deny governance.

Windows Hello protects asymmetric credentials with a device-local user gesture. The action is relevant to device-bound passwordless Windows sign-in rather than initial credential enrollment.

Authenticator approvals add an interactive possession-based sign-in step. The action is relevant to mobile authenticator challenge rather than initial credential enrollment.

FIDO2 authenticator assertions resist phishing and can be portable. This helps with external roaming security-key sign-in instead of the required initial credential enrollment.

App registration defines the OAuth/OIDC client identity. That addresses initial app integration configuration, whereas the current case requires per-user API authorization.

Enterprise app assignments govern permitted organizational access. It is used for targeted enterprise application usage; this scenario calls for per-user API authorization.

App-only grants permit background operations within authorized scope. It is used for unattended app API execution; this scenario calls for per-user API authorization.