Pass Your Microsoft AB-900 Exam Easy!

App registration defines the OAuth/OIDC client identity. That addresses initial app integration configuration, whereas the current case requires per-user API authorization.

Enterprise app assignments govern permitted organizational access. It is used for targeted enterprise application usage; this scenario calls for per-user API authorization.

App-only grants permit background operations within authorized scope. It is used for unattended app API execution; this scenario calls for per-user API authorization.

Eligibility indicates potential activation; active state indicates current authority. Its purpose is accurate temporary privilege state; the specified need is targeted stronger authentication enrollment.

Directory membership can trigger license assignment and removal. It would support lifecycle-based license provisioning, not the stated targeted stronger authentication enrollment.

Named locations provide reusable network context for sign-in conditions. Its purpose is trusted office network classification; the specified need is targeted stronger authentication enrollment.

Guest access allows limited collaboration while retaining external identity origin. This helps with access for a named external partner instead of the required cohort-based application authorization.

The service principal represents an application instance in the directory. The action is relevant to tenant-scoped enterprise application identity rather than cohort-based application authorization.

Member identities represent primary internal workforce accounts. The action is relevant to an internal organization identity rather than cohort-based application authorization.

App selection determines which resource sign-ins are evaluated. It is used for scope of a particular protected app; this scenario calls for safe policy impact analysis.

Grant controls define conditions that a sign-in must satisfy. That addresses required additional authentication for selected users, whereas the current case requires safe policy impact analysis.

Network conditions and block decisions enforce location restrictions. It is used for explicit access denial from restricted locations; this scenario calls for safe policy impact analysis.

Sign-in logs show application, error code and Conditional Access outcome. Its purpose is failed sign-in evidence; the specified need is identity-wide recommended hardening actions.

User-risk signals assess possible identity compromise. It would support aggregated account compromise risk, not the stated identity-wide recommended hardening actions.

Directory audit events attribute administrative changes. Its purpose is author and time of policy change; the specified need is identity-wide recommended hardening actions.

Password-based SSO can store and supply credentials for incompatible legacy apps. The action is relevant to legacy password-oriented app access rather than reduced repeated prompts in managed sessions.

SAML exchanges signed assertions for federated application authentication. The action is relevant to standards-based SAML sign-in rather than reduced repeated prompts in managed sessions.

OIDC adds identity tokens over an OAuth-based authorization flow. This helps with OIDC identity federation instead of the required reduced repeated prompts in managed sessions.

Approval gates enforce oversight on privileged activation. That addresses independently approved privilege activation, whereas the current case requires accountable temporary role usage.

PIM reports expose eligible and active role assignment lifetimes. It is used for upcoming privileged entitlement expiry; this scenario calls for accountable temporary role usage.

PIM eligibility separates standing rights from temporary activated privileges. It is used for just-in-time role elevation; this scenario calls for accountable temporary role usage.

Registration stores the application's identity configuration and API permission declaration. Its purpose is developer-side application identity definition; the specified need is governance of application-level API access.

Enterprise apps represent tenant-local service principals and user assignments. It would support tenant access to deployed SaaS app, not the stated governance of application-level API access.

Managed identities provision service identity tokens without customer-managed credentials. Its purpose is passwordless Azure workload identity; the specified need is governance of application-level API access.

Delegated permissions operate within the signed-in user's effective rights. The action is relevant to per-user constrained API access rather than review of existing app API privileges.

Application permissions support app-only access independent of a user session. This helps with unattended API access with no user instead of the required review of existing app API privileges.

Admin consent governs permissions that exceed user grant rights. The action is relevant to elevated consent for high-impact API scopes rather than review of existing app API privileges.

Authentication strength constrains eligible methods beyond generic MFA. It is used for stronger phishing-resistant sign-in methods; this scenario calls for risk-triggered denial.

The grant relies on evaluated management compliance state. It is used for access only from policy-compliant endpoints; this scenario calls for risk-triggered denial.

Hybrid-join grant conditions assess the required device trust. That addresses hybrid device-trust gated access, whereas the current case requires risk-triggered denial.

Assigned groups allow direct intentional membership control. It would support curated manually approved group access, not the stated temporary high-privilege access.

Access packages automate approved and time-limited resource assignment. Its purpose is request-based temporary bundle access; the specified need is temporary high-privilege access.

Dynamic groups evaluate member properties without manual updates. Its purpose is attribute-driven group population; the specified need is temporary high-privilege access.