Pass Your Microsoft AB-900 Exam Easy!

Assigned groups allow direct intentional membership control. It would support curated manually approved group access, not the stated temporary high-privilege access.

Access packages automate approved and time-limited resource assignment. Its purpose is request-based temporary bundle access; the specified need is temporary high-privilege access.

Dynamic groups evaluate member properties without manual updates. Its purpose is attribute-driven group population; the specified need is temporary high-privilege access.

Temporary Access Pass supports bootstrapping and recovery of strong authentication. The action is relevant to first-time credential bootstrap rather than current factor enrollment evidence.

Method policies control allowed registration and use of methods. This helps with scoped passkey eligibility instead of the required current factor enrollment evidence.

Removing obsolete method registration enables controlled credential recovery. The action is relevant to safe replacement of an authentication device rather than current factor enrollment evidence.

User risk evaluates the likelihood of a compromised identity. It is used for response to account-level compromise; this scenario calls for termination of active compromised sign-ins.

Sign-in risk reports assess one authentication event. That addresses troubleshooting one anomalous authentication, whereas the current case requires termination of active compromised sign-ins.

Risk remediation records resolution after recovery action. It is used for clearing a verified recovered user-risk case; this scenario calls for termination of active compromised sign-ins.

Provisioning logs report account synchronization and processing outcomes. Its purpose is app identity provisioning diagnostics; the specified need is end-to-end identity incident timeline.

Sign-in records capture authentication results and policy enforcement. Its purpose is per-attempt sign-in investigation; the specified need is end-to-end identity incident timeline.

Audit events record administrative directory object changes. It would support attribution of directory updates, not the stated end-to-end identity incident timeline.

What If evaluates policy applicability under selected inputs. This helps with prospective policy applicability for one scenario instead of the required controlled emergency account resilience.

Real sign-in logs record policies and grants evaluated at that event. The action is relevant to diagnosis of actual conditional access denial rather than controlled emergency account resilience.

Report-only calculates hypothetical results without enforcing denial. The action is relevant to safe initial assessment of policy impact rather than controlled emergency account resilience.

Access reviews enable accountable periodic entitlement recertification. It is used for periodic membership review; this scenario calls for just-in-time privileged administration.

Entitlement packages bundle resource access and request policies. That addresses delegated temporary external onboarding, whereas the current case requires just-in-time privileged administration.

Lifecycle workflows automate identity-related events and task sequences. It is used for automated workforce identity transitions; this scenario calls for just-in-time privileged administration.

Secure Score aggregates security recommendations across Microsoft security controls. Its purpose is broad cloud security posture recommendations; the specified need is Copilot adoption measurement.

Identity Secure Score focuses identity-specific hardening measurements. It would support identity-only configuration improvements, not the stated Copilot adoption measurement.

Compliance Manager organizes control assessments and improvement actions. Its purpose is formal compliance control improvement; the specified need is Copilot adoption measurement.

Tenant collaboration policies govern permitted partner organizations. The action is relevant to partner domain allow/deny governance rather than expired external collaboration rights.

B2B collaboration grants scoped resource access to external identities. The action is relevant to ordinary external guest collaboration rather than expired external collaboration rights.

Direct connect supports certain cross-organization shared-channel experiences. This helps with cross-tenant Teams shared-channel participation instead of the required expired external collaboration rights.

Windows Hello protects asymmetric credentials with a device-local user gesture. That addresses device-bound passwordless Windows sign-in, whereas the current case requires mobile authenticator challenge.

TAP is designed for controlled bootstrap and account recovery. It is used for initial credential enrollment; this scenario calls for mobile authenticator challenge.

FIDO2 authenticator assertions resist phishing and can be portable. It is used for external roaming security-key sign-in; this scenario calls for mobile authenticator challenge.

App registration defines the OAuth/OIDC client identity. Its purpose is initial app integration configuration; the specified need is unattended app API execution.

Enterprise app assignments govern permitted organizational access. It would support targeted enterprise application usage, not the stated unattended app API execution.

Delegated scopes act under user identity and permissions. Its purpose is per-user API authorization; the specified need is unattended app API execution.

Directory membership can trigger license assignment and removal. The action is relevant to lifecycle-based license provisioning rather than accurate temporary privilege state.

Named locations provide reusable network context for sign-in conditions. This helps with trusted office network classification instead of the required accurate temporary privilege state.

Authentication method policy governs permitted method populations. The action is relevant to targeted stronger authentication enrollment rather than accurate temporary privilege state.