In Azure AD Privileged Identity Management (PIM), MFA can be enforced at role activation. The setting "On activation, require Azure MFA: Yes" means a user must complete MFA each time they activate the role.
Because the "Activation maximum duration (hours)" is 8 hours, any user who needs the User Administrator role beyond that window must re-activate the role and therefore perform MFA again. The study guide explains: "Requiring MFA on activation ensures strong verification at the moment privileges are eleva ted." It also states: "Activation maximum duration controls how long the user holds the role before needing to re- activate." For approvals, the role settings show "Require approval to activate: Yes" and "Approvers: None." PIM behavior for Azure AD roles is that "if no approver list is configured for a role, activation requests are routed to Privileged Role Administrators and Global Administrators." The exam materials emphasize: "Privileged Role Administrator manages role settings, including approval workflows, and can approve eligible activations; Global Administrator also has approval capability when no explicit approvers are defined." Therefore, the correct selections are 8 hours for MFA (per activation window) and global administrator or privileged role administrator as the approver when none are explicitly assigned.

See the Explanation for the complete step by step solution.
Explanation:
To create a group named "Audit" and ensure that its members can activate the Security Reader role, follow these steps:
* Open the Microsoft Entra admin center:
* Sign in with an account that has the Security Administrator or Global Administrator role.
* Navigate to Groups:
* Go to Teams & groups > Active teams and groups1.
* Create the security group:
* Select Add a security group.
* On the Set up the basics page, enter "Audit" as the group name.
* Add a description if necessary and choose Next1.
* Edit settings:
* On the Edit settings page, select whether you want Microsoft Entra roles to be assignable to this group and select Next1.
* Assign roles:
* After creating the group, go to Roles > All roles.
* Find and select the Security Reader role.
* Under Assignments, choose Assign.
* Select the "Audit" group to assign the role to its members2.
* Review and finish:
* Review the settings to ensure the "Audit" group is created with the ability for its members to activate the Security Reader role.
* Finish the setup and save the changes.
By following these steps, you will have created the "Audit" group and enabled its members to activate the Security Reader role, which allows them to view security-related information without having permissions to change it. Remember to communicate the new group and role assignment to the relevant stakeholders in your organization.

Conditional Access policies evaluate Assignments (users, cloud apps), optional Conditions , and then enforce Access controls . In SC-300, Terms of use (ToU) is enforced via Grant controls : the policy must " require terms of use " so that users must accept a specified ToU before access is granted. The documentation states that the ToU experience is applied when a policy includes the control to " require terms of use ," and this control lives under the Grant section (alongside controls like require MFA, require compliant device, etc.
). Therefore, to deploy Terms1 with Policy1 , configure the Grant controls and select Require terms of use and choose Terms1 . Conditions or Session settings do not trigger ToU acceptance; they refine when or how access is permitted. Target resources select apps, but the enforcement of acceptance is strictly a Grant control.

In Microsoft Entra (Azure AD) app registrations, permissions are categorized as either delegated or application.
* Delegated permissions are used when an app acts on behalf of a user who is signed in.
* Application permissions are used when an app acts as itself, without user interaction - typically for background services, daemons, or APIs.
Because App1 is a service application that will:
* Run without user interaction,
* Access the Microsoft Graph API, and
* Collect audit logs (sign-in logs) -
It requires application permissions such as AuditLog.Read.All or Directory.Read.All granted to the app identity itself.
Microsoft documentation states:
"Applications that run as background services or daemons use application permissions when calling Microsoft Graph APIs that access organization data without a signed-in user."

To enforce a Terms of Use (ToU) prompt when users sign in, the SC-300 exam and Microsoft Learn materials specify configuring it under a Conditional Access policy. The ToU object must first be created in Microsoft Entra ID # Identity Governance # Terms of Use, then linked to a Conditional Access policy via Grant Controls # Require Terms of Use.
Access packages and lifecycle workflows (A, C) handle identity lifecycle and provisioning, not authentication- time prompts. Authentication methods (D) manage how users sign in but not policy-based ToU enforcement.