Pass Your Microsoft AB-900 Exam Easy!

Service entitlements should match web-mail needs without assuming installed apps. It would support lightweight web/email licensing, not the stated why a licensed user's feature is unavailable.

Office desktop licensing is separate from web-only access. Its purpose is locally installed productivity entitlements; the specified need is why a licensed user's feature is unavailable.

Premium protection features require matching service plans or add-on entitlement. It would support licensed advanced security capability, not the stated why a licensed user's feature is unavailable.

A verification token proves control of the domain namespace. This helps with prove tenant control of public domain instead of the required inventory of organization-approved domains.

MX records direct inbound email delivery to the receiving mail system. The action is relevant to route incoming mail to the intended provider rather than inventory of organization-approved domains.

The default domain influences new user principal names when created. This helps with default sign-in suffix for new accounts instead of the required inventory of organization-approved domains.

Message center posts describe upcoming service changes and actions. That addresses advance feature-release communication, whereas the current case requires purchased and consumed subscription capacity.

Service health aggregates provider incident information rather than per-user adoption. That addresses provider service availability report, whereas the current case requires purchased and consumed subscription capacity.

Usage reports summarize consumption trends by workload and user populations. It is used for Teams usage adoption statistics; this scenario calls for purchased and consumed subscription capacity.

Limiting permissions reduces potential misuse or compromise of the assigned account. It would support minimal rights for a defined support task, not the stated explicit verification instead of perimeter trust.

Assuming breach prioritizes lateral-movement detection and impact reduction. Its purpose is containment of an already-compromised session; the specified need is explicit verification instead of perimeter trust.

One trusted network path does not justify bypassing subsequent authorization. It would support repeated resource-specific trust decisions, not the stated explicit verification instead of perimeter trust.

Authentication success does not override resource-level authorization. This helps with resolving missing file entitlements instead of the required validation of the sign-in principal.

Authorization decides what an authenticated principal can perform. This helps with permission enforcement after sign-in instead of the required validation of the sign-in principal.

Audit records attribute administrative mutations to the responsible identity. The action is relevant to accountability for privileged modifications rather than validation of the sign-in principal.

Temporary Access Pass supports time-limited bootstrap of stronger authentication. It is used for time-limited onboarding authentication; this scenario calls for phishing-resistant authenticator.

MFA combines independent verification factors to reduce password-only risk. That addresses a policy requiring more than a password, whereas the current case requires phishing-resistant authenticator.

TOTP creates rotating codes based on a shared secret and clock. That addresses rotating authenticator verification code, whereas the current case requires phishing-resistant authenticator.

User risk concerns compromised account likelihood while sign-in risk concerns an event. It would support differentiation of identity and event risk, not the stated risk-adjusted interactive sign-in.

Explicit access block can enforce prohibited locations despite other grants. Its purpose is location-based access denial; the specified need is risk-adjusted interactive sign-in.

Report-only records what a policy would do before enforcement. It would support simulated risk-policy deployment, not the stated risk-adjusted interactive sign-in.

Identity Secure Score evaluates identity protection configuration signals. This helps with Entra-focused identity hardening instead of the required broad Microsoft 365 security posture prioritization.

Compliance Manager organizes assessment controls and evidence beyond security score. The action is relevant to regulatory compliance improvement planning rather than broad Microsoft 365 security posture prioritization.

Adoption metrics capture use patterns, not security configuration gaps. This helps with product usage measurement rather than security score instead of the required broad Microsoft 365 security posture prioritization.

Security reporting summarizes incident and alert activity over time. That addresses aggregate threat detection trends, whereas the current case requires unified threat investigation.

Advanced hunting supports query-based threat exploration over available event data. That addresses proactive event-based threat hunting, whereas the current case requires unified threat investigation.

Alerts contain the detection's individual evidence and context. It is used for alert-level security evidence; this scenario calls for unified threat investigation.

Anti-phishing policy can evaluate spoofing and impersonation signals. Its purpose is executive impersonation defense; the specified need is URL-click protection for email and Office content.

Email investigation tools show message detections, delivery and remediation events. It would support investigating malicious mail delivery, not the stated URL-click protection for email and Office content.

Safe Attachments analyzes suspicious files using supported detonation workflows. It would support malware inspection of email attachments, not the stated URL-click protection for email and Office content.

The Office workload product focuses on mail and collaboration threats. This helps with email and collaboration threat protection instead of the required endpoint process-level threat investigation.

Defender for Identity observes supported identity infrastructure and activities. The action is relevant to on-premises identity attack detection rather than endpoint process-level threat investigation.

Cloud app security observes and governs cloud application activity. This helps with SaaS usage threat control instead of the required endpoint process-level threat investigation.