In Microsoft Entra Permissions Management (formerly CloudKnox), the Permissions Management Administrator role provides the least-privilege rights necessary to onboard cloud environments such as Azure subscriptions, AWS accounts, or GCP projects. This role allows users to configure data collection and onboard environments without granting global administrative access.
The Global Administrator role could also perform onboarding but exceeds the least-privilege requirement.
Microsoft's official documentation (SC-300 "Manage Microsoft Entra Permissions Management" module) clearly states:
"The Permissions Management Administrator can onboard and configure environments for Permissions Management and manage discovery and insights across multi-cloud platforms."

In Azure AD Privileged Identity Management (PIM), the SC-300 materials explain that role assignment type determines how a user obtains permissions. An eligible assignment means the user requests activation when needed; an active assignment grants continuous permissions. As the guide states, "Eligible assignments require the user to activate the role for just-in-time access, while active assignments grant standing access." To allow users of the User administrator role to request the role when needed , you must set assignments to Eligible rather than active.
The same objective also calls for ensuring this capability is available "for up to one year." In PIM role configuration, the duration of an eligibility is controlled by the Expire eligible assignments after policy. The documentation describes that administrators can "configure the maximum duration for eligible assignments by setting 'Expire eligible assignments after' to a specific period (for example, months up to one year)." Therefore, you must modify the "Expire eligible assignments after" setting to the required period.
No requirement mentions activation justification or ticket metadata; those are optional controls used to add context to activations. Consequently, the two actions that directly satisfy the stated technical requirement are:
set all assignments to Eligible (C) and configure "Expire eligible assignments after" (D) .

According to the Microsoft SC-300 Study Guide and Microsoft Learn module: "Implement and manage smart lockout and password protection", Smart Lockout is a feature of Microsoft Entra Password Protection that helps prevent brute-force attacks by locking out accounts after repeated failed sign-in attempts.
The configuration for Smart Lockout includes two primary settings:
* Lockout threshold - the number of failed sign-ins before locking the account.
* Lockout duration - how long the account remains locked before another attempt is allowed.
These settings are managed under Password protection in the Entra admin center, not under user or sign-in risk policies (those are part of Identity Protection) or authentication strengths.
By configuring the lockout threshold to 10 failed sign-ins, you meet the requirement.

To enable Security defaults for contoso.com, you should first sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator. Then, browse to Azure Active Directory > Properties and select Manage security defaults. Set the Enable security defaults toggle to Yes and select Save.
After that, you can assign Admin1 the Identity Administrator role for Au1 to enable them to manage security defaults for the tenant.
https://practical365.com/what-are-azure-ad-security-defaults-and-should-you-use-them/

Explanation:
Box 1 =
SigninLogs
| where ResultType == 0
| summarize login_count = count() by identity
| render piechart
This query retrieves the sign-in logs, filters the successful sign-ins,summarizesthe count of sign-ins per user, and renders the result as a pie chart.
Box 2 = Render
In Microsoft Entra ID (Azure AD), the SigninLogs table in Azure Monitor Logs (Log Analytics workspace) contains data about user sign-ins. When you want to query and graphically display the number of sign-ins per user, you use Kusto Query Language (KQL) - the same language that powers Log Analytics, Azure Monitor, and Microsoft Sentinel.
The correct syntax must first aggregate the data and then visualize it:
* where ResultType == 0 filters for successful sign-ins (since 0 indicates success).
* summarize login_count = count() by Identity aggregates (counts) all sign-in events per user ( Identity field). The summarize operator in KQL is specifically used to group and aggregate data.
* render columnchart graphically displays the summarized results as a column chart. The render operator is used to visualize query output in supported formats such as timechart , piechart , or columnchart .
Therefore, the correct operators to fill in are:
* First blank: summarize
* Second blank: render
According to the Microsoft SC-300 Study Guide and Microsoft Learn module "Query and visualize sign-in logs with Kusto Query Language" , the recommended method to display sign-in frequency per user is:
"Use the summarize operator to aggregate sign-in counts by user, followed by render to visualize results."
# Final Query Answer:
SigninLogs
| where ResultType == 0
| summarize login_count = count() by Identity
| render columnchart