Explanation:

According to the Microsoft SC-300: Identity and Access Administrator official study guide and the Microsoft Learn "Implement and manage Azure AD Identity Protection" module, Azure AD Identity Protection detects two primary categories of risks: user risks and sign-in risks.
* User Risk Policy:A user risk represents the probability that a user's identity (credentials) has been compromised. Examples of user risk signals include leaked credentials, unusual sign-ins from different geographies, or sign-ins from infected devices. The Exam Ref SC-300 specifically lists "leaked credentials detected on the dark web or other compromised repositories" as the main trigger for a user risk policy. Such a policy can automatically force password change or enforce MFA to remediate the threat.
* Sign-in Risk Policy:A sign-in risk reflects the likelihood that a specific authentication attempt is not performed by the legitimate user. Sign-in risk is based on context, such as sign-ins from suspicious browsers, anonymous IP addresses (like TOR networks), or impossible travel scenarios. The SC-300 documentation highlights these examples as conditions best handled with a sign-in risk policy, where conditional access can block or require MFA for the risky sign-in attempt.
Therefore:
* Leaked credentials are addressed through a User Risk Policy, since the account itself is compromised.
* Sign-ins from suspicious browsers and access from anonymous IP addresses are handled through Sign- in Risk Policies, as they relate to risky sessions rather than compromised identities.

Explanation:

According to the Microsoft SC-300: Microsoft Identity and Access Administrator Official Study Guide and Microsoft Learn - Manage Conditional Access policies module, when an administrator creates a Conditional Access policy using the built-in Require password change for high-risk users template, the policy is automatically pre-configured with specific include and exclude assignments.
By default, this template targets "All users" in the tenant because the policy is designed to detect and remediate risky sign-ins or compromised accounts across the entire directory. However, since Azure AD B2B guest accounts and external users often have limited sig n-in scopes and cannot be subjected to organization- specific password policies, Microsoft's security baseline specifically excludes all guest and external users by default.
The intent behind this default configuration is to apply the password change requir ement to internal users while avoiding unnecessary enforcement on guest identities that do not manage credentials within the host tenant.
From the Microsoft Learn - Conditional Access policy templates documentation:
"When you create a policy from the Requi re password change for high-risk users template, the policy is configured to include all users and exclude all guest and external users by default."

Per the Microsoft SC-300: Identity and Access Administrator official study guide and Microsoft Learn module: "Implement Conditional Access policies", the enforcement of Terms of Use (ToU) acceptance for accessing organizational resources is done through Conditional Access policies in Microsoft Entra ID.
After uploading a Terms of Use PDF and assigning it to users, administrators must link that ToU to a Conditional Access policy to ensure that only users who have accepted the ToU can access corporate apps or data. The Conditional Access engine enforces this by evaluating whether the user's ToU status equals
"accepted" at sign-in. If not, access is denied until the user accepts the terms.
The Exam Ref SC-300 clarifies:
"Terms of Use documents are enforced through Conditional Access policies. You can require users to accept the terms before accessing specified apps or resources." Alternative options such as Intune compliance policies or Defender for Cloud Apps access policies manage device compliance and session control, but they do not enforce Entra ToU acceptance.

See the Explanation for the complete step by step solution.
Explanation:
To implement additional security checks for the Sg-Executive group members before they can access any company apps, you can use Conditional Access policies in Microsoft Entra. Here's a step-by-step guide:
* Sign in to the Microsoft Entra admin center:
* Ensure you have the role of Global Administrator or Security Administrator.
* Navigate to Conditional Access:
* Go to Security > Conditional Access.
* Create a new policy:
* Select + New policy.
* Name the policy appropriately, such as "Sg-Executive Security Checks".
* Assign the policy to the Sg-Executive group:
* Under Assignments, select Users and groups.
* Choose Select users and groups and then Groups.
* Search for and select the Sg-Executive group.
* Define the application control conditions:
* Under Cloud apps or actions, select All cloud apps to apply the policy to any company app.
* Set the device compliance requirement:
* Under Conditions > Device state, configure the policy to include devices marked as compliant by Microsoft Intune.
* Set the app protection policy requirement:
* Under Conditions > Client apps, configure the policy to include client apps that are protected by app protection policies.
* Configure the access controls:
* Under Access controls > Grant, select Grant access.
* Choose Require device to be marked as compliant and Require approved client app.
* Ensure that the option Require one of the selected controls is enabled.
* Enable the policy:
* Set Enable policy to On.
* Review and save the policy:
* Review all settings to ensure they meet the requirements.
* Click Create to save and implement the policy.
By following these steps, you will ensure that the Sg-Executive group members can only access company apps if they meet one of the specified conditions, either by using a compliant device or a protected client app.
This enhances the security posture of your organization by enforcing stricter access controls for executive- level users.

Explanation:
User
Portal to Use
User1
Azure Active Directory admin center
User2
Microsoft 365 compliance center
User3
Microsoft Endpoint Manager admin center
This question tests your knowledge of Microsoft 365 administrative roles and their associated management portals, as defined in the Microsoft Identity and Access Administrator (SC-300) Exam Study Guide and Microsoft Learn's "Manage identity and access in Microsoft Entra ID and Microsoft 365" module.
Let's analyze each user and the roles assigned:
* Roles:
* User Administrator
* Device Administrator
* Identity Governance Administrator
User1 These are all Azure AD-based roles.
* The User Administrator role allows the management of users, groups, and password resets in Azure AD.
* The Device Administrator role applies to Azure AD joined devices.
* The Identity Governance Administrator manages Access Reviews, Entitlement Management, and Terms of Use, all of which are under Azure AD Identity Governance.
According to Microsoft documentation:
"User, Device, and Identity Governance Admin istrators perform their management tasks in the Azure Active Directory admin center." Portal: Azure Active Directory admin center
* Roles:
* Records Management
* Quarantine Administrator
User2 These are Microsoft Purview compliance roles, used for managing retention policies, data lifecycle management, and quarantine of messages/files.
Both are managed through the Microsoft 365 compliance center (previously known as the Security & Compliance Center). Microsoft documentation:
"Records Management and Quarantine A dministrator roles allow access to compliance features such as data retention, auditing, and message quarantine, all of which are configured from the Microsoft 365 compliance center." Portal: Microsoft 365 compliance center
* Roles:
* Endpoint Security Manager
* Intune Role Administrator
User3 These roles are directly tied to Microsoft Endpoint Manager (Intune).
* The Endpoint Security Manager configures device compliance, security baselines, and endpoint protection.
* The Intune Role Administrator manages Intune roles and permissions.
Microsoft documentation:
"Administrators managing Intune roles and endpoint security policies use the Microsoft Endpoint Manager admin center (https://endpoint.microsoft.com)." Portal: Microsoft Endpoint Manager admin center