The question asks which role allows a user to create access reviews for Azure AD roles using the principle of least privilege.
* Privileged Role Administrator can manage all role assignments and access reviews, but it has more privileges than needed.
* Identity Governance Administrator manages entitlement management and access packages, not Azure AD roles directly.
* User Administrator can manage users but not access reviews for roles.
* # User Access Administrator is the correct least-privilege role, as it allows management of access reviews related to Azure AD roles and role-assignable groups.
From Microsoft Documentation (SC-300 Exam Guide):
"The User Access Administrator role allows management of access reviews and permissions for Azure AD roles and resources using the least-privileged approach."

Explanation:

According to the official Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn documentation ("Manage External Identities in Microsoft Entra ID"), External Identities in Microsoft Entra ID allow organizations to collaborate securely with users outside the organization using features like B2B collaboration and B2C self-service sign-up.
Let's analyze the two required configurations:
* B2B Collaboration:The External collaboration settings page is where administrators configure how external users (guests) interact with internal resources. This includes settings for guest user invitations, collaboration restrictions, redemption policies, and access permissions for B2B users. Microsoft documentation clearly states:
"Use External collaboration settings to manage the behavior and restrictions of B2B collaboration users in your directory." Therefore, to enable or adjust B2B collaboration, you must configure External collaboration settings.
* Monthly Active Users (MAU)-based pricing:Microsoft Entra External Identities pricing is based on Monthly Active Users (MAU), which must be linked to an Azure subscription for billing purposes. This configuration is found under Linked subscriptions. Microsoft's documentation explains:
"To enable MAU-based billing for your External Identities, you must link your Microsoft Entra tenant to an Azure subscription under the 'Linked subscriptions' option." Linking the subscription allows Microsoft to bill based on the number of active external users each month, aligning with the MAU pricing model.
Therefore:
* B2B collaboration # External collaboration settings
* MAU-based pricing # Linked subscriptions

Explanation:
According to the Microsoft SC-300: Identity and Access Administrator Official Study Guide and Microsoft Learn module "Configure Azure AD Multi-Factor Authentication settings", the Account Lockout settings in Azure AD MFA define how the service reacts to repeated failed MFA verification attempts.
From the exhibit:
* Number of MFA denials to trigger account lockout: 3
* Minutes until account lockout counter is reset: 60
* Minutes until account is automatically unblocked: 30
1. Lockout trigger type:
The lockout applies to MFA denials - specifically, failed verification attempts using methods such as the Microsoft Authenticator app (OTP code) or phone call verification. It does not apply to incorrect usernames or passwords, as those are handled by Azure AD sign-in risk policies.
The official Microsoft documentation states:
"Account lockout in Azure AD Multi-Factor Authentication occurs after the configured number of denied MFA verification attempts. This setting applies to users entering an incorrect PIN or app verification code." Therefore, after three incorrect Microsoft Authenticator app codes, the account is temporarily locked.
2. Lockout duration:
The setting "Minutes until account is automatically unblocked: 30" means that once an account is locked due to too many failed MFA attempts, it will automatically unlock after 30 minutes without administrator intervention.
This aligns with Microsoft's MFA service behavior:
"When the account lockout threshold is reached, the account remains locked for the configured duration before being automatically unlocked."
# Final Correct Answers:
* Wrong input type causing lockout: Microsoft Authenticator app code
* Unlock duration: 30 minutes

Explanation:

According to the Microsoft SC-300 Study Guide and the official Microsoft Learn module: "Manage user accounts in Microsoft Entra ID", when a user account is deleted from Microsoft Entra ID (formerly Azure AD), the deleted user object is soft-deleted and retained in the Deleted Users container for 30 days.
During this retention period, the user can be restored with all associated attributes, such as group memberships and licenses, unless a permanent (hard) delete is performed before the 30-day period ends. After the 30-day soft-delete retention period expires, the user object and all related data are permanently removed from the tenant and cannot be recovered.
Microsoft documentation states:
"When a user is deleted, the account is retained in a soft-deleted state for 30 days. During that time, an administrator can restore the user from the Azure portal or by using PowerShell." To perform the restoration, the least privileged role that has this permission is the User Administrator.
The User Administrator can:
* Restore deleted users.
* Reset passwords for non-admin users.
* Create, edit, and delete standard user accounts.
Higher-level roles (e.g., Global Administrator or Privileged Role Administrator) also have this ability but are not required - thus, User Administrator is the least privileged appropriate role.

Explanation:

According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and Microsoft Learn modules on "Implement access management for apps" and "Implement Conditional Access policies", Azure AD provides centralized identity and access management for integrated SaaS applications (such as Service1) that support Azure AD authentication and OAuth.
* Ensure that users connect to Service1 without being prompted for authentication:When a third- party application is published in the Azure AD gallery, it supports federated single sign-on (SSO) using SAML, OAuth, or OpenID Connect.Registering the application as an enterprise application (rather than creating a new app registration) enables Azure AD to manage SSO automatically.The Microsoft documentation states:
"Enterprise applications from the Azure AD gallery can be configured for single sign-on so that users can access the app using their Azure AD credentials without being prompted to reauthenticate." Therefore, to achieve seamless sign-on with minimal administrative overhead, the correct option is An enterprise application in Azure AD.
* Ensure that users can access Service1 only from Azure AD-joined computers:To restrict access based on device compliance or join status, Azure AD uses Conditional Access policies.Conditional Access allows enforcement of conditions such as "Require device to be marked as compliant" or
"Require hybrid Azure AD-joined or Azure AD-joined device."The official Microsoft guidance under
"Plan and implement Conditional Access policies" confirms:
"You can enforce that users only access cloud resources from devices that are Azure AD-joined or compliant by applying Conditional Access device filters." Thus, to ensure that only Azure AD-joined devices can access Service1, you implement a Conditional Access policy.