IT Support and IAM

Compare the roles of Active Directory Domain Services, Microsoft Entra ID, and Microsoft 365.

Distinguish cloud-only, synchronized, and federated user identities.

Differentiate Microsoft identity objects for users, groups, devices, applications, and service principals.

Explain the relationships among a Microsoft Entra tenant, verified domain, subscription, and Microsoft 365 organization.

Interpret common identity attributes including UPN, email address, object ID, and SID.

Determine the authoritative identity source in a hybrid-environment scenario.

Trace a user sign-in from a client through the relevant Microsoft identity service.

Locate common identity-management tasks in simulated Microsoft administration portals.

Interpret the relationships among forests, domains, domain controllers, and organizational units.

Create a simulated Active Directory user with appropriate identity attributes.

Modify, disable, and expire a simulated Active Directory account.

Perform a secure password reset and account unlock in a simulated support case.

Choose the correct Active Directory group type and scope for a stated requirement.

Assign group membership using a role-based access requirement.

Determine effective file access from share permissions, NTFS permissions, and group membership.

Interpret Group Policy results that affect a user's sign-in or workstation access.

Create and update a simulated Microsoft Entra user account.

Distinguish member users from guest users in a collaboration scenario.

Restore or permanently remove a simulated deleted user.

Assign a Microsoft 365 license that satisfies a user's service requirements.

Manage static Microsoft Entra group membership from an approved request.

Construct a dynamic group membership rule from stated criteria.

Distinguish registered, Entra-joined, and hybrid-joined device states.

Perform a simulated bulk user operation using a validated CSV file.

Compare password hash synchronization, pass-through authentication, and federation.

Evaluate password, MFA, and passwordless authentication options for a stated risk level.

Select appropriate Microsoft Entra authentication methods for a user population.

Resolve a simulated self-service password reset registration failure.

Handle a lost or replaced MFA device using a secure recovery process.

Interpret the users, resources, conditions, and controls in a Conditional Access policy.

Predict the result of a Conditional Access policy using a simulated What If analysis.

Determine when a Temporary Access Pass is appropriate for user onboarding or recovery.

Differentiate Microsoft Entra roles, Azure resource roles, Microsoft 365 roles, and application roles.

Select the least-privileged built-in role for a stated administrative task.

Evaluate whether a custom role is justified for a set of permissions.

Determine a user's effective access from direct, group-based, and inherited assignments.

Identify a separation-of-duties conflict in a privileged-access request.

Explain how Microsoft Entra Privileged Identity Management reduces standing privilege.

Complete a simulated time-bound privileged-role activation.

Document an approval decision for a privileged-access request.

Translate a hiring event into an approved account-provisioning checklist.

Translate a role change into required access additions and removals.

Translate a departure into a time-sensitive deprovisioning checklist.

Apply group-based licensing to a sample workforce population.

Evaluate access-review results and select appropriate remediation actions.

Select an access package for a recurring internal or external access need.

Identify dormant, orphaned, and improperly shared accounts from sample records.

Define ownership, credential rotation, and review requirements for a service account.

Distinguish SAML, OpenID Connect, OAuth 2.0, and WS-Federation by purpose.

Trace the OAuth 2.0 authorization-code flow in a web application scenario.

Differentiate ID tokens, access tokens, and refresh tokens.

Interpret SAML claims and attributes used for application authorization.

Select delegated or application permissions for a Microsoft Graph use case.

Evaluate an application consent request for least privilege and business need.

Map source and target attributes for simulated SCIM user provisioning.

Diagnose a simulated SSO failure involving a reply URL, claim, certificate, or assignment.

Apply a structured troubleshooting sequence to a Microsoft sign-in failure.

Use simulated Entra sign-in logs to identify the cause of a failed authentication.

Interpret an identity-related Microsoft error code, timestamp, and correlation ID.

Diagnose an Active Directory account lockout from sample events and account data.

Distinguish access failure caused by licensing, group membership, policy, or service health.

Resolve a simulated access delay caused by token or directory synchronization timing.

Identify the audit-log entries relevant to a reported account change.

Assemble an escalation package containing reproducible steps, logs, scope, and attempted fixes.

Differentiate password spraying, credential phishing, MFA fatigue, and token theft.

Assess a simulated risky sign-in using user, device, location, and session evidence.

Select containment actions for a suspected compromised Microsoft account.

Revoke sessions and require secure credential re-registration in a simulated incident.

Evaluate a baseline Conditional Access policy set against common identity attacks.

Define safe configuration and monitoring requirements for emergency-access accounts.

Separate privileged and everyday accounts for an administrative user.

Write a concise identity-compromise response runbook.

Connect safely to a simulated Microsoft Graph PowerShell session with limited permissions.

Query selected user and group properties with Microsoft Graph PowerShell.

Filter and export identity records for an access review.

Validate input data before a bulk identity operation.

Apply preview and confirmation controls to a simulated bulk change.

Automate a group-membership update from an approved input file.

Construct a basic Microsoft Graph API request for identity data.

Add error handling and an audit log to a short IAM administration script.

Prioritize a mixed queue of IAM and Microsoft 365 support tickets by impact and urgency.

Resolve a simulated new-starter account and access request from intake to closure.

Resolve a simulated locked-account and MFA-recovery case from intake to closure.

Resolve a simulated unauthorized-access report from intake through escalation.

Write a user-facing knowledge-base article for a common identity support issue.

Communicate an identity issue and next steps to both a user and a technical stakeholder.

Create a sanitized IAM operations portfolio containing tickets, scripts, diagrams, and runbooks.

Demonstrate IAM troubleshooting and least-privilege reasoning in a mock job interview.