MS-900 Practice Questions

The error message, "You don't have permission to create a support request," explicitly indicates that the user's account lacks the required administrative privileges. In Microsoft 365, creating support requests is an administrative task. Only users assigned to specific administrative roles, such as Global Administrator or Service Support Administrator, are granted the permissions to contact Microsoft support on behalf of the organization. A standard user without an appropriate admin role will receive this message and must contact an internal administrator to log the request.

A. A disabled account would prevent the user from signing into Microsoft 365 services altogether, not just from creating a support request.

B. A missing license would prevent the user from accessing the specific application, but it does not control the administrative permission to create support tickets.

D. All Microsoft 365 business and enterprise subscriptions include the ability to create standard support requests. Premier (or Unified) support is an enhanced, paid offering and is not required to open a ticket.

1. Microsoft. (2024). Get support - Microsoft 365 admin. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide. In the "Who can open a service request?" section

it states

"Users with the service support admin role

as well as global administrators

can open service requests."

2. Microsoft. (2024). About admin roles in the Microsoft 365 admin center. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide. Under the "Service support admin" role description

the permissions include: "Can open support requests with Microsoft." This confirms it is a role-based permission.

To determine the number of devices running each operating system in Microsoft Intune, an administrator must navigate to the Devices blade. This blade provides an overview of all managed devices, including charts that break down the device count by platform (operating system). The "All devices" view within this blade also allows for filtering and sorting by the OS, providing the exact information required by the scenario. The "Mobile Apps" blade is used for application lifecycle management, not device inventory reporting.

A. Device configuration: This blade is used for creating and managing profiles to control settings and features on devices, not for viewing inventory reports.

B. Device compliance: This blade is used to create and monitor policies that define the rules and settings devices must meet to be considered compliant.

C. No change is needed: This is incorrect because the "Mobile Apps" blade is for managing applications, not for viewing a breakdown of devices by operating system.

1. Microsoft Learn. (2023). View device details in Microsoft Intune. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-inventory.

Reference Point: The document explicitly states

"The Microsoft Intune admin center gives you details about the devices you manage... To see your devices

sign in to the Microsoft Intune admin center

and select Devices > All devices." The "All devices" list includes columns for "OS" and "OS version".

2. Microsoft Learn. (2023). Microsoft Intune admin center walk-through. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/mem/intune/fundamentals/tutorial-walkthrough-intune-portal.

Reference Point: In the "Devices" section of the walkthrough

it describes the blade: "In Devices

you can see a list of the managed devices in your tenant

and get to device-specific tasks... The Overview page shows a visual snapshot of the enrolled devices

how many devices are using the different platforms

and more." This confirms the Devices blade is the correct location for OS platform counts.

The Microsoft Compliance Manager portal can be used to create data loss prevention (DLP) policies. (No)

Data Loss Prevention (DLP) policies are created and managed within the Microsoft Purview compliance portal, not specifically within the Compliance Manager tool. The Compliance Manager is a risk assessment and management tool used to track, assign, and verify your organization's compliance activities related to Microsoft Cloud services. It helps you manage compliance, but it is not the interface for creating technical enforcement policies like DLP.

The Microsoft Service Trust portal can be used to provide financial compliance and standards reports. (Yes)

The Microsoft Service Trust Portal is the central repository for accessing documentation about Microsoft's security, privacy, and compliance practices. It provides a wide array of resources, including independent third-party audit reports such as SOC (Service Organization Controls) and ISO/IEC, which are critical for validating financial compliance and adherence to industry standards.

Microsoft Learn. (2024). Learn about data loss prevention. Microsoft Docs. In the section "Where are the DLP policies," it states, "DLP policies are configured in the Microsoft Purview compliance portal." It does not mention the Compliance Manager as the tool for creation.

Microsoft Learn. (2024). Microsoft Purview Compliance Manager. Microsoft Docs. This document describes Compliance Manager as a feature that "helps you manage your organization’s compliance requirements with greater ease and convenience." Its function is centered on assessment and tracking, not policy creation.

Microsoft Learn. (2024). Get started with Microsoft Service Trust Portal. Microsoft Docs. This official documentation explicitly states that the portal contains "Audit Reports," including "independent audit reports of Microsoft cloud services... such as Service Organization Controls (SOC)... and ISO/IEC." These reports are fundamental for financial compliance verification.

The problem described is that the recipient's user account cannot be authenticated by the sender's Azure Active Directory (Azure AD), which is a prerequisite for decrypting content protected by Azure Information Protection (AIP). "RMS for individuals" is a free, self-service subscription from Microsoft designed specifically for this situation. It allows a user, whose organization does not have Azure AD, to create an identity in Azure AD using their business email address. This new identity can then be authenticated, allowing the user to open and consume content that has been protected by the Azure Rights Management (RMS) service from another company.

B. Implementing Information Rights Management (IRM) in an Office application only enables the client-side feature; it does not solve the backend authentication failure with Azure AD.

C. Upgrading to a full AIP plan is an organizational-level action and is not necessary for an individual to simply consume a protected document sent from an external party.

1. Microsoft Documentation

"RMS for individuals and Azure Information Protection": "RMS for individuals is a free self-service subscription for users in an organization that does not have a Microsoft 365 or Azure AD subscription

and who need to open files that are protected by Azure Rights Management... If these users cannot be authenticated by Azure AD

they cannot open the protected content. The free RMS for individuals subscription solves this problem."

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/information-protection/rms-for-individuals

Section: "RMS for individuals and Azure Information Protection".

2. Microsoft Documentation

"Azure Information Protection frequently asked questions": In response to the question "Can I share protected documents with people outside my company?"

the documentation states: "Yes... If the recipient's email account isn't in Azure AD

they can sign up for RMS for individuals."

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/information-protection/faq

Section: "Sharing protected documents".

Viva Insights is the correct solution for the first requirement because it is specifically designed to provide personal analytics about an individual's work patterns. It includes metrics on meeting habits, such as the percentage of meetings joined on time and the rate of multitasking (e.g., reading or sending emails) during meetings. This directly addresses the need to determine how individuals are engaging with their scheduled meetings.

Supply Chain insights, part of the Microsoft Dynamics 365 suite, is the appropriate choice for the second requirement. Its core function is to provide business leaders with data-driven visibility and analytics into supply chain operations. This empowers them to address critical operational questions and make informed decisions, which aligns perfectly with the stated requirement.

Microsoft Viva Insights Documentation:

According to the official Microsoft Learn documentation, Viva Insights helps people and businesses thrive with data-driven, privacy-protected insights. The Personal insights feature specifically provides information about an individual's meeting habits.

Source: Microsoft Learn, "Meeting habits in Viva Insights." The documentation details how Viva Insights tracks metrics like "Joined on time" and "During-meeting multitasking rate."

Microsoft Dynamics 365 Supply Chain Insights Documentation:

The official documentation states that Dynamics 365 Supply Chain Insights enables organizations to proactively predict and manage supply chain disruptions. It provides analytics to empower business leaders.

Source: Microsoft Learn, "Dynamics 365 Supply Chain Insights overview." This document explicitly outlines the solution's purpose as providing "visibility of the supply chain" and "supply chain analytics" for leaders.

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MS-900/page_216_img_2.jpg

Yes: Azure Conditional Access policies can specifically target the Microsoft Azure Management cloud app. This allows administrators to enforce controls, such as requiring multi-factor authentication (MFA), for any user attempting to access the Azure portal, Azure PowerShell, or the Azure CLI, effectively securing management tasks.

Yes: A core feature of Conditional Access is the ability to target policies based on user assignments. This includes assigning policies to users who hold specific Azure AD directory roles, such as Global Administrator or Security Administrator. Enforcing MFA for these privileged accounts is a common and highly recommended security practice.

No: App-specific settings can be applied without full device management. Microsoft Intune App Protection Policies (APP) are designed to protect organizational data within an application, regardless of whether the device itself is enrolled or managed (a scenario often called Bring Your Own Device or BYOD). These policies can control actions like copy-pasting or saving data from a managed app to an unmanaged location, even on a personal device.

Microsoft Learn. (2024). Conditional Access: Cloud apps or actions. "For customers who want to secure Microsoft Azure Management, you can target the Microsoft Azure Management application in the cloud apps picker. When you scope this application, policies are enforced for tokens issued to Azure Resource Manager API endpoints." See section: "Microsoft Azure Management".

Microsoft Learn. (2024). Conditional Access: Conditions. "The users condition allows you to include or exclude specific sets of users from a policy. This condition can include... Directory roles (Preview) - Users assigned specific Azure AD roles." See section: "Directory roles".

Microsoft Learn. (2023). What are app protection policies?. "App protection policies (APP) are rules that ensure an organization's data remains safe or contained in a managed app. A policy can be a rule that is enforced when the user attempts to access or move 'corporate' data... App protection policies can be configured for apps that run on devices that are... Not enrolled in any mobile-device management (MDM) solution." See section: "How you can protect app data".

Speaker Coach is an AI-powered feature in Microsoft PowerPoint and Teams designed to help users improve their presentation skills. It analyzes various aspects of delivery, including pace, pitch, filler words, and, crucially, can use the device's camera to provide feedback on the presenter's body language, such as making eye contact and maintaining an appropriate distance from the camera.

Microsoft Editor is an intelligent writing assistant available across Microsoft 365 apps. Its primary function is to enhance written communication by providing real-time recommendations for spelling, grammar, clarity, conciseness, and style, ensuring that documents and emails are professional and error-free.

Microsoft Support. (n.d.). Rehearse your slide show with Speaker Coach.

Details: This official documentation explains the capabilities of Speaker Coach. Under the "Body Language" section for PowerPoint for the web, it states, "Turn on your video camera and get feedback on your body language... Body language feedback gives you feedback on: Clear view: Make sure your face is visible... Distance: Avoid being too close or too far from the camera... Eye contact: Maintain eye contact with your audience." This directly supports matching Speaker Coach with the body language feedback requirement.

Microsoft Support. (n.d.). Microsoft Editor checks grammar and more in documents, mail, and the web.

Details: This article details the functionality of Microsoft Editor. It specifies, "Microsoft Editor is an AI-powered service that helps bring out your best writer... Editor points out issues in your writing and offers suggestions for spelling, grammar, and style." This confirms that Microsoft Editor is the correct tool for recommendations on spelling and grammar.

Exchange Online is the service that provides hosted email, calendaring, and contact management capabilities within Microsoft 365. It is the core service for communication via email. Microsoft Teams is a collaboration platform that integrates chat, meetings, calling, and content sharing into a single application. It serves as a central hub for real-time communication and teamwork. Microsoft Stream is a video service for creating, managing, and sharing videos, which doesn't fit either scenario. Therefore, the correct matches are Exchange Online for email, calendar, and contacts, and Microsoft Teams for meetings, chat, and calling.

Microsoft Exchange Online - Microsoft Learn, "About Exchange Online", last modified July 2024, section "Exchange Online features" provides details on email, calendar, and contacts.

Microsoft Teams - Microsoft Learn, "Microsoft Teams features", last modified August 2024, section "Core capabilities" outlines meetings, chat, and calling functionalities.

Microsoft 365 Licensing Documentation - Microsoft Docs, "Microsoft 365 and Office 365 service descriptions", last modified July 2024, section "Service descriptions for individual services" clarifies the distinct capabilities of Exchange Online and Microsoft Teams.

Microsoft ensures protection in its multitenant cloud environment through a defense-in-depth strategy. This includes physical, logical, and data-layer controls.

1. BitLocker Encryption (A): At the physical layer, BitLocker AES 256-bit encryption is used on all servers, encrypting customer data at rest on the disk volumes. This protects against unauthorized access to the underlying hardware.

2. Azure AD Isolation (B): At the logical layer, each tenant is a discrete, isolated container within Azure Active Directory (Azure AD). Azure AD enforces strict security boundaries, using role-based access control (RBAC) to ensure that credentials for one tenant cannot access the resources of another.

3. Application-Level Isolation (F): Services like Exchange Online are designed for multitenancy, meaning mailboxes from multiple tenants are stored in the same databases. Protection is provided by application-level code that enforces tenant isolation, ensuring no tenant can access or view the data of another.

C. Transport Layer Security (TLS) is a protocol used to encrypt data in transit over a network, not data at rest on a server.

D. Azure AD provides authorization at the identity and application layers. The transport layer is responsible for data transmission, not user authorization or access control.

E. This describes a dedicated or single-tenant architecture. The standard Microsoft 365 multitenant environment intentionally and securely stores data from multiple tenants in shared databases.

1. Microsoft Trust Center. (n.d.). Encryption in Microsoft 365. Microsoft. Retrieved from https://learn.microsoft.com/en-us/purview/encryption.

Section: "Encryption technologies in Microsoft 365" -> "Volume-level encryption". This section explicitly states

"Data at rest in Microsoft 365 is encrypted at the physical level with BitLocker." This supports answer A and refutes C's application to data at rest.

2. Microsoft. (2023

October 18). Isolation and Access Control in Microsoft 365. Microsoft Learn.

Section: "Tenant Isolation". This document details how Azure Active Directory provides a security boundary for each tenant. It states

"The logical isolation of customer content for each tenant is achieved through Azure Active Directory." This supports answer B.

3. Microsoft. (2023

October 18). Isolation and Access Control in Microsoft 365. Microsoft Learn.

Section: "Service-Specific Isolation" -> "Isolation in Exchange Online". This section explains

"Exchange Online stores data from multiple tenants in the same databases... Exchange Online application logic ensures that tenants can only manage and see their own mailboxes and recipients." This supports the architectural fact in F and explains the protection mechanism

while refuting E.

Microsoft Bookings is a scheduling application within Microsoft 365 designed to simplify the process of booking appointments. A key feature is its native integration with Microsoft Teams, which allows for the automatic creation of a unique Teams meeting link for each virtual appointment scheduled. This streamlines the process for both the service provider and the customer. Additionally, Bookings enhances communication and reduces no-shows by providing the capability to send automated SMS text message notifications and reminders to customers about their upcoming appointments, alongside standard email confirmations.

A. Bookings provides email and SMS notifications for appointments, but it does not have a native feature for automated phone call notifications.

D. Yammer is an enterprise social networking service for internal communication and community building, not a platform for hosting virtual meetings scheduled through Bookings.

1. Microsoft Learn. (2023). What is Bookings? "Bookings is integrated with your Microsoft 365 or Office 365 calendar... Email and SMS text notifications reduce no-shows and enhance customer satisfaction." and "You and your staff can use the Bookings web app or Bookings in Teams." This source supports both correct answers (B and C).

2. Microsoft Learn. (2023). Create a Bookings calendar. Under the "Add online meeting" section

it states

"The option to add an online meeting to services creates a virtual meeting option for your staff and customers. Each appointment will have a unique meeting link created for it that customers and staff can join at the time of the appointment." This directly supports option B.

3. Microsoft Learn. (2023). Set up SMS text notifications for appointments in Microsoft Bookings. "With a Bookings license

you can enable SMS text message notifications to be sent to the person booking an appointment." This directly supports option C.

4. Microsoft Learn. (2023). Overview of Yammer. This document describes Yammer's purpose for communication and engagement

confirming it is not a virtual meeting tool like Teams

which invalidates option D.