Explanation:
< [answer choice] can access App1 from the homepage URL: # Only users listed on the Users and groups blade App1 will appear in the Microsoft Office 365 app launcher for [answer choice]: # Only users listed on the Users and groups blade

According to Microsoft's official documentation and the SC-300: Microsoft Identity and Access Administrator study guide, when you register and configure an enterprise application in Azure Active Directory, two specific settings directly influence user visibility and access:
* User assignment required?
* If this option is set to Yes, Azure AD requires users to be explicitly assigned to the app before they can sign in.
* Only users or groups listed on the Users and groups blade (app assignments) will have access.
* This means that even if the application is visible in Azure AD, users not assigned to it cannot authenticate or launch it.
* Visible to users?
* If set to Yes, the app appears in the Microsoft 365 app launcher (also known as the My Apps portal).
* However, when "User assignment required" is Yes, the visibility is limited only to those who are assigned to the app.
From the exhibit:
* "User assignment required?" = Yes
* "Visible to users?" = Yes
This configuration implies:
* Only assigned users (those listed on the Users and groups blade) can sign in to App1 via the homepage URL.
* App1 will appear in the Microsoft 365 app launcher (My Apps portal) only for those same assigned users.
As per Microsoft Learn documentation ("Manage enterprise apps in Azure AD"):
"When User assignment required is set to Yes, only users assigned to the application can access it. If Visible to users is also Yes, the application will appear in My Apps for those assigned users."

SC-300 emphasizes using Conditional Access with named locations to scope MFA-especially to exclude trusted corporate egress IPs . The materials state that administrators can define named locations by public IP ranges and "mark them as trusted" for policy exceptions. This aligns with the requirement: enforce MFA for all users, but exempt users authenticating from the Boston office. Because Azure AD evaluates the client's public egress address, private RFC1918 ranges are never seen by Azure AD on the internet, so defining private IP ranges would not work. Likewise, the legacy "Trusted IPs" setting belongs to the old per-user MFA service settings; SC-300 guidance prefers Conditional Access named locations for modern MFA deployments and for combining with other conditions (apps, platforms, user risk, locations). Implementing the Boston office as a named location using its public egress IP range(s), and marking it trusted, lets you exclude that location from the tenant-wide MFA policy while still meeting the broader requirement to enforce MFA for everyone else and for on-prem apps published via Azure AD Application Proxy. In short: define Boston's public IP as a named location and use it in your Conditional Access policy exclusion to satisfy the exemption precisely and securely.
Topic 3, A Datum CorpOverview
A Datum Corporation is a consulting company in Montreal.
A Datum recently acquired a Vancouver-based company named Litware, Inc.
A Datum Environment
The on-premises network of A. Datum contains an Active Directory Domain Services (AD DS) forest named adatum.com.
A Datum has a Microsoft 365 E5 subscription. The subscription contains a verified domain that syncs with the adatum.com AD DS dom ain by using Azure AD Connect A Datum has an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant has Security defaults disabled.
The tenant contains the users shown in the following table.
Problem Statements
A Datum identifies the foll owing issues:
* Multiple users in the sales department have up to five devices. The sales department users report that sometimes they must contact the support department to join their devices to the Azure AD tenant because they have reached their device li mit.
* A recent security incident reveals that several users leaked their credentials, a suspicious browser was used for a sign-in, and resources were accessed from an anonymous IP address,
* When you attempt to assign the Device Administrators role To IT_ Group1, the group does NOT appear in the selection list.
* Anyone in the organization can invite guest users, including other guests and non-administrators.
* The helpdesk spends too much time resetting user passwords.
* Users currently use only passwords for authentication.
Requirements
A Datum plans to implement the following changes;
* Configure self-service password reset {SSPR}.
* Configure multi-factor authentication (MFA) for all users.
* Configure an access review for an access package named Package1.
* Require admin approval for application access to organizational data.
* Sync the AD DS users and groupsoflitware.com with the Azure AD tenant.
* Ensure that only users that are assigned specific admin roles can invite guest users.
* Increase th e maximum number of devices that can be joined or registered to Azure AD to 10.
Technical Requirements
A Datum identifies the following technical requirements:
* Users assigned the User administrator role must be able to request permission to use the rol e when needed for up to one year.
* Users must be prompted to register for MFA and provided with an option to bypass the registration for a grace period.
* Users must provide one authentication method to reset their password by using SSPR. Available method s must include:
* Email
* Phone
* Security questions
* The Microsoft Authenticator app
* Trust relationships must NOT be established between the adatum.com and litware.com AD DS domains.
* The principle of least privilege must be used.

Azure AD MFA Fraud alert is explicitly documented in the SC-300 content as the control to combat push- bombing. The documentation explains: "Enable Fraud alert so users can report unexpected MFA prompts; when configured to block the user , Azure AD marks the user as blocked automatically upon the fraud report.
" It also notes: "The block remains in effect (default 90 days) until an administrator unblocks the user." This directly satisfies the requirement to automatically block users when they report that they did not initiate the sign-in. Other MFA configurations-such as account lockout thresholds-address repeated denial scenarios and rate-limiting but do not trigger an immediate block as a result of a user's fraud report. Configuring Fraud alert therefore meets the goal exactly, aligning with SC-300's best-practice guidance for protecting users from unsolicited MFA prompts.

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Entra ID (Azure AD) documentation , sign-in logs are the primary source for diagnosing and troubleshooting authentication and access issues for Azure AD-integrated services, including Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) .
The sign-in logs record all user authentication attempts - successful and failed - along with critical d etails such as:
* User identity (User Principal Name)
* Application name (in this case, "Microsoft Cloud App Security" or "Microsoft Defender for Cloud Apps")
* IP address and device details
* Conditional Access policy outcomes
* Failure reasons (e.g., MFA requireme nt, denied by Conditional Access, invalid token, etc.) These logs can be accessed directly from the Microsoft Entra admin center # Monitoring # Sign-in logs .
They allow administrators to quickly identify why a user was unable to access a specific cloud ser vice , without needing to configure or collect extra data sources.
Other log types do not fit this scenario:
* Audit logs record changes (e.g., policy updates, role assignments) but not authentication attempts.
* Provisioning logs track synchronization and prov isioning events from connected applications.
* Log Analytics is a log aggregation workspace; it's not the first-line diagnostic tool and requires extra configuration.
Hence, to identify the cause of User1's access error with minimal administrative effort , th e correct choice is sign-in logs .

Explanation:

According to Microsoft's SC-300 Study Guide , Exam Ref SC-300: Microsoft Identity and Access Administrator , and the Azure AD Identity Protection documentation , leaked credentials and risky sign-ins are detected and managed through Azure AD Identity Protection. This service identifies, categorizes, and automates the mitigation of risks related to user and sign-in behavior.
* Classify leaked credentials as high-risk:
* Azure AD Identity Protection automatically flags users as high-risk if their credentials appear in public or dark web breach data. Microsoft continuously monitors leaked credentials and matches them against Azure AD user accounts.
* The guide states: "Azure AD Identity Protection detects when user credentials are found on public credential dumps and flags those users as high-risk."
* Trigger remediation:
* The appropriate signal to trigger a policy response for leaked credentials is User risk, not sign-in risk.
* User risk evaluates the likelihood that a user's identity has been compromised, while sign-in risk deals with suspicious conditions during authentication.
* From Microsoft's documentation: "User risk policy is used to automatically remediate leaked credentials by requiring the user to change their password."
* Mitigate the risk:
* To mitigate the risk while still allowing access, the best practice is to grant access but require a password change . This satisfies the requirement to "immediately enforce a control" without fully blocking the user.
* The SC-300 study materials confirm: "When user risk is high, organizations can configure policies to allow sign-in but require a password change to remediate risk."