☁️ Section 1: Microsoft 365 Fundamentals (Questions 1–15)
1. Tell us about your Microsoft 365 administration experience.
"Over the past 3 years, I have served as an M365 Administrator managing hybrid identities via Entra Connect, Exchange Online mail flow, Teams policy deployment, SharePoint/OneDrive external sharing governance, Intune enrollment, and Security & Compliance controls including Conditional Access and Defender for Office 365."
2. What are the core workloads and services in Microsoft 365?
- Identity & Access: Microsoft Entra ID (Azure AD).
- Communication & Collaboration: Exchange Online, Microsoft Teams, SharePoint Online, OneDrive for Business.
- Endpoint Management: Microsoft Intune.
- Security & Governance: Defender for Office 365 / Endpoint, Microsoft Purview (DLP, Compliance, Information Protection).
3. Explain the underlying architecture of a Microsoft 365 tenant.
A tenant is a dedicated instance of Microsoft 365 services bound to a Microsoft Entra ID organization directory. Services operate as multi-tenant microservices hosted in geo-redundant Microsoft datacenters, communicating via Graph APIs and unified identity tokens.
4. What is the difference between Microsoft 365 and Office 365?
- Office 365: Suite of cloud-based productivity apps (Exchange, Word, Excel, Teams, SharePoint).
- Microsoft 365: Broader enterprise bundle containing Office 365 + Windows Enterprise OS licensing + Enterprise Mobility + Security (EMS: Intune, Entra ID P1/P2, Defender).
5. Explain Microsoft Entra ID (formerly Azure Active Directory).
Microsoft Entra ID is a cloud-based Identity and Access Management (IAM) service. Unlike traditional Active Directory (which uses Kerberos/NTLM and LDAP), Entra ID uses modern OAuth 2.0, OpenID Connect, and SAML 2.0 protocols over HTTPS to authenticate users across M365 and SaaS apps.
6. What is a Microsoft 365 Tenant and how is it identified?
An isolated partition of cloud services assigned to an enterprise. Identified globally by a unique Tenant ID (GUID) and initial fallback domain string (e.g., company.onmicrosoft.com). Custom domain names (e.g., company.com) are verified and bound to this tenant.
7. How do Microsoft 365 Subscriptions, Licenses, and Service Plans relate?
A **Subscription** represents the agreement/plan purchased. It contains **Licenses** (assigned to individual user accounts). Each license comprises multiple **Service Plans** (individual feature toggles, such as Exchange Online Plan 2 or Microsoft Teams) that can be individually enabled or disabled per user.
8. What is the difference between Business Premium, Enterprise E3, and Enterprise E5 licenses?
- Business Premium: Max 300 users; includes M365 Apps, Exchange, Teams, Intune, Entra ID P1, and Defender for Business.
- Enterprise E3: Unlimited user scaling; adds 100GB mailboxes, In-Place Hold, DLP, and Windows Enterprise licensing.
- Enterprise E5: Advanced suite adding Entra ID P2, Defender for Endpoint/Office 365 Plan 2, Teams Phone, PowerBI Pro, PIM, and Purview Advanced eDiscovery.
9. How do you assign and remove licenses using Group-Based Licensing?
Configure Group-Based Licensing in Entra ID Admin Center: Assign an M365 license directly to an Entra ID Security Group. When users are added or removed from the group, Entra ID automatically provisions or harvests their licenses without manual admin intervention.
10. What are Administrative Roles in Microsoft 365 and the Principle of Least Privilege?
M365 uses Role-Based Access Control (RBAC). Roles delegate granular permissions (e.g., **Exchange Administrator** for mail flow, **User Administrator** for password resets, **Global Reader** for auditing) instead of assigning **Global Administrator** rights universally.
11. How do you create a new user account in Microsoft 365?
- Cloud-Only: Via M365 Admin Center, Entra ID portal, or PowerShell (`New-MgUser`).
- Hybrid: Created in on-premises AD, synced to Entra ID via Entra Connect Sync, and assigned a license via Group-Based Licensing.
12. How do you reset a user password and manage cached credentials?
Admin executes reset in M365 Admin Center / Entra ID, checking "Require change on first login". For hybrid users with Password Writeback enabled, reset writes back to on-prem AD instantly. On the endpoint, clear cached tokens via `cmdkey /delete` or sign out of Office app settings.
13. How do you manage Guest Users (B2B Collaboration) in M365?
Invite external partners via Entra ID B2B collaboration. Governed by External Collaboration Settings, restricting guest permissions, enforcing MFA and device compliance via Conditional Access, and auditing guest lifecycle using Entra Access Reviews.
14. How do you monitor Microsoft 365 Service Health and track incident alerts?
Monitor the **Service Health Dashboard** in M365 Admin Center. Subscribe to real-time email alerts, integrate incidents into ServiceNow via Graph API, or monitor service status using the Admin mobile app and M365 Service Communications API.
15. What is the Microsoft 365 Admin Center and what primary consoles reside within it?
The central web portal (`admin.microsoft.com`) for managing users, billing, licenses, and support tickets. Links out to specialized workload admin centers: Exchange (EAC), Teams Admin Center (TAC), SharePoint Admin Center, Entra ID, Intune, and Security & Compliance (Purview).
📧 Section 2: Exchange Online (Questions 16–35)
16. Explain Exchange Online architecture and database redundancy.
Exchange Online delivers cloud email hosted across geo-redundant datacenters. Mailbox databases are organized in Database Availability Groups (DAGs), continuously replicating active mailbox copies to multiple passive nodes across regions to ensure immediate automatic failover.
17. What is an Exchange Mailbox and what are its core data components?
A cloud storage repository for email, calendars, contacts, and tasks. Contains hidden working tables (MAPI items), search indexes, deleted items tables, and dumpster locations (`Recoverable Items` folder) for data compliance.
18. What is the difference between a User Mailbox and a Shared Mailbox?
- User Mailbox: Requires a paid license; associated with an individual user account for direct interactive logon.
- Shared Mailbox: Free up to 50GB (unlicensed); associated with a disabled login account; accessed by multiple delegates using Full Access and Send As permissions.
19. What is the difference between a Distribution List, Mail-Enabled Security Group, and Microsoft 365 Group?
- Distribution List (DL): Static broadcast list for routing email to members.
- Mail-Enabled Security Group: Routes email AND grants access permissions to corporate resources.
- Microsoft 365 Group: Modern collaboration group providing a shared Exchange mailbox, calendar, Teams channel, SharePoint site, Planner, and OneNote.
20. How do you create and configure a Shared Mailbox?
In Exchange Admin Center (EAC) → Teams & groups → Shared mailboxes → Add shared mailbox. Configure delegation under **Read and manage permissions (Full Access)** and **Send as permissions**. Enable "Sent Items Delegation" so copies of sent messages save to the shared mailbox.
21. Explain Mailbox Delegation types (Full Access, Send As, Send on Behalf).
- Full Access: Grants delegate complete rights to open and read mailbox contents (does not allow sending as the mailbox).
- Send As: Allows delegate to send email appearing as though sent directly by the mailbox owner (`From: SharedMailbox`).
- Send on Behalf: Allows sending email where header explicitly states delegation (`From: Delegate on behalf of SharedMailbox`).
22. Explain Exchange Mail Flow and MX record evaluation.
External sender DNS queries recipient's MX record → MX points to Exchange Online Protection (`domain-com.mail.protection.outlook.com`) → EOP evaluates connection, anti-spam, transport rules → Message delivered to Exchange Online mailbox database.
23. Explain SPF, DKIM, and DMARC record setup in Exchange Online.
- SPF (TXT): `v=spf1 include:spf.protection.outlook.com -all` (authorizes M365 outbound mail IPs).
- DKIM (CNAME): Points selector CNAMEs to Microsoft to sign outgoing messages with private keys.
- DMARC (TXT): `v=DMARC1; p=quarantine;` specifies enforcement action if SPF/DKIM validation fails.
24. What is an MX Record and how is it configured during M365 setup?
Mail Exchanger (MX) record is a DNS resource record pointing to the mail servers handling email for a domain. Configured during domain setup with lowest priority preference value (e.g., `Priority: 0`) pointing to `company-com.mail.protection.outlook.com`.
25. How do you troubleshoot mail delivery issues using Message Trace?
Open EAC → Mail flow → Message trace. Input sender, recipient, and date range. Inspect message status (`Delivered`, `Failed`, `Pending`, `Expanded`). Click trace record to view detailed events (EOP spam filtering rules, transport rule evaluation, bounce codes).
26. What is an Exchange Transport Rule (Mail Flow Rule)?
Actionable rule evaluated on messages in transit across the tenant. Composed of **Conditions** (e.g., sender is external), **Actions** (e.g., prepend disclaimer `[External]`, block message, redirect), and **Exceptions**.
27. How do you configure Automatic Replies (Out of Office) for a user?
Via Outlook app, OWA settings, or centrally via EAC / Exchange Online PowerShell: `Set-MailboxAutoReplyConfiguration -Identity "user@domain.com" -AutoReplyState Enabled -InternalMessage "OOF Text" -ExternalMessage "OOF Text"`.
28. How do you recover deleted email items in Exchange Online?
User recovers items from OWA/Outlook "Recover Deleted Items" option. As an admin, recover items retained in the hidden `Recoverable Items` folder via EAC or PowerShell: `Restore-RecoverableItems -Identity "user@domain.com"`. For compliance holds, use Content Search in Microsoft Purview.
29. What is Litigation Hold and how does it preserve mailbox data?
Preserves all mailbox items (including deleted items and original versions of modified items) indefinitely or for a specified duration for legal and eDiscovery compliance. Data is stored invisibly in the `Purges` subfolder of `Recoverable Items`.
30. What is an Archive Mailbox and Auto-Expanding Archiving?
Provides additional storage space for older email items. Enabled per user; moves historical items based on Retention Tags. **Auto-Expanding Archiving** automatically provisions additional storage blocks up to 1.5 TB as the archive approaches capacity (E5 / Exchange Plan 2).
31. How do you troubleshoot Outlook client connectivity failures?
- Test OWA access to verify credentials and server availability.
- Test MAPI/HTTPS port connectivity: `Test-NetConnection outlook.office365.com -Port 443`.
- Inspect Autodiscover status (Hold `Ctrl` & right-click Outlook tray icon → Test Email AutoConfiguration).
- Run Microsoft Support and Recovery Assistant (SaRA) tool.
32. Explain Outlook Cached Exchange Mode vs Online Mode.
- Cached Mode: Downloads a copy of the mailbox to a local `.ost` file on disk for fast performance and offline availability.
- Online Mode: Connects directly to Exchange Online servers in real time without local disk caching; used on terminal servers/VDI environments to save disk space.
33. How do you troubleshoot Autodiscover failures in Outlook?
Verify DNS CNAME record `autodiscover.outlook.com` points correctly. Inspect local Windows Registry keys under `HKCU\Software\Microsoft\Office\16.0\Outlook\AutoDiscover` for stale `ExcludeExplicitO365Endpoint` settings. Test XML response payload using Microsoft SaRA tool.
34. What tools do you use for Exchange Online troubleshooting?
Exchange Admin Center (EAC), Exchange Online PowerShell module (`Get-EXOMailbox`, `Get-MessageTrace`), Microsoft Remote Connectivity Analyzer (`testconnectivity.microsoft.com`), Microsoft Message Header Analyzer, and Microsoft SaRA.
35. How do you manage distribution group delivery management and moderation?
Configure DL properties in EAC: Set **Delivery Management** to restrict senders (e.g., allow only internal senders or specific groups) and configure **Message Approval** to assign group moderators who must approve incoming broadcasts before delivery.
💬 Section 3: Microsoft Teams (Questions 36–50)
36. Explain Microsoft Teams underlying backend architecture.
Teams is an orchestration layer integrating M365 services: Group chats stored in Exchange Online hidden mailboxes, Team file shares stored in SharePoint Online site document libraries, 1-on-1 chat files stored in OneDrive, and media streams processed via Azure Communications Services (ACS).
37. What is the difference between Teams, Standard Channels, and Shared Channels?
- Team: Top-level collaboration workspace bound to a M365 Group.
- Standard Channel: Visible to all team members.
- Private Channel: Restricted workspace accessible to a subset of team members with its own dedicated SharePoint site.
- Shared Channel: Accessible to internal and external partners via B2B Direct Connect without switching tenant contexts.
38. How do you create and manage Microsoft Teams policies?
Administered via Teams Admin Center (TAC) or Teams PowerShell module. Policies (Messaging, Meeting, Calling, App Permission) are created centrally and assigned globally (Org-wide default), assigned to custom groups, or assigned directly to individual users.
39. How do you troubleshoot Microsoft Teams sign-in errors?
Verify M365 user license includes Microsoft Teams service plan. Inspect Entra ID Sign-In logs for Conditional Access blocks or MFA failures. Clear Teams client cache (`%localappdata%\Packages\MSTeams_8wekyb3d8bbwe`). Test web access via `teams.microsoft.com`.
40. How do you troubleshoot audio, video, and screen sharing performance issues in Teams?
Inspect Teams Admin Center → User detail → Call History → Call Quality Dashboard (CQD). Review network metrics: **Latency (<50ms)**, **Jitter (<30ms)**, and **Packet Loss (<1%)**. Verify corporate firewall/proxy allows UDP ports `3478-3500`.
41. Explain Teams Meeting Policies and guest controls.
Configured in TAC → Meetings → Meeting policies. Controls features like Lobby bypass settings (e.g., "People in my org"), screen sharing permissions, cloud recording enablement, and meeting chat availability for external guest participants.
42. Explain Microsoft Teams Calling options (Calling Plans vs Direct Routing vs Operator Connect).
- Microsoft Calling Plan: Microsoft acts as the PSTN telecom carrier providing phone numbers and calling packages.
- Direct Routing: Connects customer-owned PSTN trunks and Session Border Controllers (SBCs) to Teams.
- Operator Connect: Managed PSTN connectivity provided directly by partner telecom operators via cloud APIs.
43. What is a Session Border Controller (SBC) in Teams Direct Routing?
A dedicated voice gateway device/virtual appliance installed on network boundaries that translates SIP signals and media traffic between private PSTN telecom infrastructure and Microsoft Teams Phone Cloud platform.
44. How do you manage Guest Access in Microsoft Teams?
Enable Guest Access in Teams Admin Center. Governed by M365 Group external sharing settings and Entra ID B2B policies. Controls whether guests can use screen sharing, private calls, edit messages, or access channel files.
45. Explain Teams App Permission Policies and Setup Policies.
- App Permission Policies: Controls which apps (Microsoft, Third-party, Custom) users can install and use.
- App Setup Policies: Controls which apps are automatically pinned to the Teams left navigation bar for users.
46. How do you clear Microsoft Teams client cache on Windows?
- Right-click Teams icon in taskbar → Quit.
- Press `Win + R` → paste `%localappdata%\Packages\MSTeams_8wekyb3d8bbwe` (New Teams) or `%appdata%\Microsoft\Teams`.
- Delete all files in folder and relaunch Teams.
47. How do you monitor real-time Teams call quality using Call Quality Dashboard (CQD)?
Access CQD (`cqd.teams.microsoft.com`). Review tenant-wide network performance reports, analyze audio stream quality across building subnets, identify Wi-Fi vs wired degradation, and isolate ISP bandwidth bottlenecks.
48. What diagnostic logs are useful when troubleshooting Microsoft Teams?
Use keyboard shortcut `Ctrl + Alt + Shift + 1` in Teams to generate **Diagnostic Logs**. Inspect **Desktop Logs** (`%appdata%\Microsoft\Teams\logs.txt` or WebView2 logs) and **Media Logs** (`%appdata%\Microsoft\Teams\media-stack*.log`) for audio/video hardware failure analysis.
49. Explain Teams Live Events vs Teams Webinars vs Town Halls.
- Teams Webinar: Interactive meeting supporting up to 1,000 attendees with registration pages and presenter controls.
- Town Hall (formerly Live Events): Large-scale one-to-many broadcast supporting up to 10,000–20,000 view-only attendees via RTMP video streaming.
50. How do you enforce external domain communication controls in Teams?
Configure External Access in TAC → External access. Set policies to allow all external domains, block specific untrusted domains, or restrict federation exclusively to an explicit whitelist of trusted business partner domains.
📁 Section 4: SharePoint Online & OneDrive (Questions 51–65)
51. What is SharePoint Online and what is its core architecture?
A cloud-based collaboration and document management platform built on Site Collections. Stores data in Document Libraries, Lists, and Pages, organized under a unified site hierarchy integrated with Microsoft 365 Groups and Entra ID permissions.
52. What is the difference between SharePoint Online and OneDrive for Business?
- OneDrive for Business: Individual cloud storage library assigned to a single user for personal draft files and working documents.
- SharePoint Online: Shared team-based document repositories and intranet sites designed for cross-departmental file collaboration and content publishing.
53. What is the difference between a Team Site and a Communication Site in SharePoint?
- Team Site: Connected to an M365 Group/Teams channel; designed for active team collaboration, internal project file sharing, and task tracking.
- Communication Site: Unconnected to an M365 Group; designed for broad "one-to-many" intranet broadcasting (news, company policies, HR portals).
54. Explain SharePoint Online permission levels and inheritance.
Permissions inherit top-down (Site Collection → Site → Library → Folder → File). Standard Groups: **Owners (Full Control)**, **Members (Edit)**, **Visitors (Read)**. Inheritance can be broken at the folder/file level to assign explicit unique permissions.
55. How do you restore deleted files in SharePoint Online and OneDrive?
Files deleted by users move to the **First-Stage Recycle Bin** (retained 93 days). If emptied, files move to the **Second-Stage (Admin) Recycle Bin** for the remainder of the 93-day window. Site admins or M365 admins can restore items directly from the admin bin.
56. Explain Version History in SharePoint Online and document recovery.
SharePoint automatically maintains version history for files in document libraries (default minimum 500 major versions). Users can view previous file versions, compare changes, and restore prior states instantly without restoring from backups.
57. How do you troubleshoot OneDrive sync client errors on endpoints?
- Check red "X" sync error icons in Windows File Explorer.
- Verify file path length (<400 characters) and invalid characters (`%`, `#`, `<`).
- Pause and resume sync client.
- Reset OneDrive client: `onedrive.exe /reset`.
58. Explain OneDrive Known Folder Move (KFM) deployment.
An enterprise policy configured via Intune/GPO that automatically redirects and syncs standard Windows user profile folders (**Desktop**, **Documents**, and **Pictures**) directly into the user's encrypted OneDrive for Business cloud storage seamlessly.
59. How do you configure External Sharing controls in SharePoint and OneDrive?
Configure in SharePoint Admin Center → Policies → Sharing. Set global tier limits: **Anyone** (anonymous links), **New and existing guests**, **Existing guests only**, or **Only people in your organization**. Enforce expiration dates and password protection on shared links.
60. How do you manage SharePoint site storage quotas and auto-expansion?
Manage in SharePoint Admin Center. Storage pools can be set to **Automatic** (tenant automatically allocates storage from total pool up to 25TB per site) or **Manual** (admins set explicit hard storage limits and warning thresholds per site).
61. How do you recover a deleted SharePoint Online Site Collection?
Open SharePoint Admin Center → Sites → **Deleted sites**. Select deleted site collection and click **Restore**. Deleted sites are retained in the tenant recycle bin for 93 days before permanent purge.
62. Explain Purview Retention Policies vs Retention Labels in SharePoint.
- Retention Policy: Applied globally or at site container level; automatically retains or purges all content after a specified time frame.
- Retention Label: Applied to specific individual files or folders based on content metadata (e.g., "Financial Records - 7 Years").
63. How do you troubleshoot "Access Denied" errors on SharePoint sites?
Use the "Check Permissions" utility in Site Settings → Site Permissions. Verify if user is listed in site Owners/Members/Visitors groups. Check if folder/file inheritance was broken, verify Conditional Access location/device compliance blocks, and clear browser session cache.
64. What is SharePoint Access Requests and Invitation Auto-Acceptance?
A workflow where unauthorized users clicking a private SharePoint link can type a request for access. Site Owners receive an email notification or Teams alert allowing them to approve or decline access with one click.
65. How do you migrate on-premises file shares to SharePoint Online using SPMT?
Deploy Microsoft SharePoint Migration Tool (SPMT) or Migration Manager in M365 Admin Center. Scan source file share paths for path length errors, map source local paths to target SharePoint document libraries, perform test migration runs, and execute delta sync passes during cutover.
🆔 Section 5: Microsoft Entra ID & Identity (Questions 66–80)
66. Explain Microsoft Entra ID object types and cloud architecture.
Entra ID is flat, non-hierarchical cloud directory storing identity objects: Users (Cloud-Only, Synced, Guest B2B), Groups (Security, M365, Dynamic), Service Principals (App Registrations), and Devices (Entra Registered, Entra Joined, Hybrid Joined).
67. Compare On-Premises Active Directory vs Microsoft Entra ID.
- On-Prem AD: Hierarchical (Forest/OU), Kerberos/NTLM authentication, LDAP queries, Group Policy management, designed for local networks.
- Entra ID: Flat web-scale structure, OAuth 2.0/OIDC/SAML protocols, REST Graph API queries, Intune MDM management, designed for cloud & mobile access.
68. Explain Azure AD Connect (Entra Connect) sync architecture.
An on-premises synchronization server agent that reads object changes from Active Directory Domain Services via LDAP/RPC and provisions/updates corresponding identity objects in Microsoft Entra ID tenant over HTTPS Graph APIs on a scheduled interval (default 30 mins).
69. Explain Password Hash Synchronization (PHS) mechanics.
Entra Connect agent extracts password hashes from on-prem AD (`NTDS.dit`), runs a 1000-iteration MD4/SHA256 cryptographic hash function on the hash, and sends the resulting password hash to Entra ID over TLS. Allows users to sign into cloud services even if on-prem DCs are offline.
70. Explain Pass-Through Authentication (PTA) vs Federation (ADFS).
- PTA: Lightweight on-prem agent validates user cloud password attempts directly against on-prem DCs in real time without storing password hashes in the cloud.
- ADFS: Legacy SAML federation server infrastructure where cloud authentication requests redirect to on-prem ADFS web servers for identity validation.
71. What is Seamless Single Sign-On (Seamless SSO) and how does it function?
Allows domain-joined corporate PCs on the local network to log into cloud M365 apps automatically without re-entering passwords. Uses a computer account created in on-prem AD (`AZUREADSSOACC`) to issue Kerberos tickets forwarded to Entra ID via browser.
72. How do you troubleshoot Entra Connect Sync errors using Synchronization Service Manager?
Launch `miisclient.exe` on Entra Connect server. Review the Operations tab for sync status errors: **`data-validation-error`**, **`duplicate-attribute`** (e.g., UPN or ProxyAddresses collision), or **`stopped-server-down`**. Use `IdFix` tool to scan on-prem AD for illegal characters.
73. How do you design and enforce Conditional Access Policies in Entra ID?
Define rules evaluating **Assignments** (Users, Cloud Apps) and **Conditions** (Location, Device State, User Risk) → Apply **Access Controls** (Require MFA, Require Compliant Device, Block Access). Test policies using **What If Tool** and deploy in **Report-only Mode** before full enforcement.
74. Explain Multi-Factor Authentication (MFA) enforcement and Number Matching.
Requires secondary proof of identity during login. Microsoft Authenticator uses **Number Matching**: The login screen displays a 2-digit number that the user must enter into their Authenticator app prompt, blocking push-fatigue fatigue attacks.
75. What are Security Defaults in Microsoft Entra ID?
Pre-configured basic security baseline provided by Microsoft for tenants without Entra ID P1/P2 licenses. Enforces mandatory MFA for all users/admins, blocks legacy authentication, and requires security verification during risky sign-ins.
76. Explain Privileged Identity Management (PIM) and Just-In-Time (JIT) access.
Entra ID P2 governance service. Administrators maintain standard user accounts by default and activate "Eligible" privileged admin roles (e.g., Global Admin) on-demand for a limited duration (e.g., 2 hours), requiring justification, ticket number, and manager approval.
77. What are Administrative Units (AUs) in Microsoft Entra ID?
Containers used to delegate regional or departmental administrative control. Users or devices are added to an AU (e.g., "London Branch AU"), and an IT engineer is assigned Helpdesk Administrator rights scoped *exclusively* to that AU.
78. How do you configure Self-Service Password Reset (SSPR) with Password Writeback?
Enable SSPR in Entra ID Admin Center. Configure mandatory registration methods (Authenticator app, phone). Enable **Password Writeback** in Entra Connect server, allowing users resetting cloud passwords to update on-premises AD passwords in real time.
79. Explain Dynamic User and Device Groups in Microsoft Entra ID.
Groups whose membership is populated automatically using rule queries based on user or device attributes (e.g., `user.department -eq "Sales"` or `device.deviceOSType -eq "Windows"`). Eliminates manual group management.
80. How do you investigate Entra ID Sign-In Logs for failed login attempts?
Open Entra ID → Monitoring → Sign-in logs. Filter by status **Failure** or **Interrupted**. Inspect diagnostic fields: **Basic Info** (IP address, user location), **Device Info** (join status, OS), **Target App**, **Conditional Access** (identifying which policy blocked login), and **Authentication Details** (error codes).
📱 Section 6: Intune & Endpoint Management (Questions 81–90)
81. What is Microsoft Intune and how does it connect to endpoints?
A cloud-based Unified Endpoint Management (UEM) platform. Devices communicate with Intune cloud microservices over HTTPS REST APIs using native OS MDM protocols (Windows `omadm`, iOS/macOS MDM specs, Android Enterprise APIs).
82. Explain device enrollment methods in Microsoft Intune across OS platforms.
- Windows: Autopilot, OOBE Entra Join, Co-management, or Automatic Enrollment via M365 app sign-in.
- iOS/macOS: Apple Automated Device Enrollment (ADE / ABM) or Company Portal app enrollment.
- Android: Android Enterprise Dedicated, Fully Managed, or Corporate-Owned Work Profile.
83. Explain Intune Compliance Policies and integration with Conditional Access.
Compliance policies evaluate endpoint security health against configured rules (minimum OS version, active BitLocker encryption, active firewall). If a device fails evaluation, Intune updates its state in Entra ID to "Non-Compliant", causing Conditional Access to block access to corporate M365 apps.
84. Explain Intune Configuration Profiles and Settings Catalog.
Configuration Profiles enforce operational and security settings on devices (Wi-Fi settings, VPN profiles, restrictions, custom registry edits). The **Settings Catalog** provides a searchable index of all available native OS Configuration Service Provider (CSP) policy settings.
85. Explain Windows Autopilot User-Driven vs Self-Deploying modes.
- User-Driven Mode: Prompts the user to enter corporate credentials during OOBE; joins device to Entra ID/Hybrid and links device to user identity.
- Self-Deploying Mode: Zero-touch; joins device to Entra ID automatically using TPM 2.0 hardware attestation without requiring user credential input (ideal for kiosks/shared PCs).
86. How do you deploy applications using Microsoft Intune (LOB vs Win32)?
- LOB (Line-of-Business): Deploys single, simple `.msi` or `.msix` setup files directly.
- Win32 Apps: Wrapped via `IntuneWinAppUtil.exe` into `.intunewin` format. Supports multi-file setups, custom install/uninstall command lines, detection rules, dependencies, and return codes.
87. How do you manage BitLocker Drive Encryption via Intune Endpoint Security?
Deploy BitLocker policy via **Endpoint Security → Disk encryption**. Configure mandatory XTS-AES 256-bit encryption, require TPM 2.0 protector, enable silent encryption for standard users without local admin rights, and enforce key backup to Entra ID.
88. What is the difference between Retiring and Wiping a device in Intune?
- Retire: Removes managed corporate data, company apps, and Intune MDM management profiles while leaving personal user data untouched (ideal for BYOD).
- Wipe: Performs a complete factory reset, erasing all user data, applications, and OS partitions back to clean out-of-box state.
89. How do you troubleshoot Intune policy sync failures on Windows endpoints?
On client: Go to **Settings → Accounts → Access work or school → Info → Click Sync**. Review Intune Management Extension (IME) logs located at `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log`. Inspect Windows Event Log under `DeviceManagement-Enterprise-Diagnostics-Provider`.
90. Explain Intune Endpoint Security Baselines and ASR rules.
Pre-configured bundles of Microsoft security settings. Includes **Attack Surface Reduction (ASR)** rules that block common attack behaviors (e.g., blocking Office apps from creating child processes, blocking credential stealing from LSASS memory).
🛡️ Section 7: Security & Compliance (Questions 91–100)
91. Explain Microsoft Defender for Office 365 (Plan 1 vs Plan 2).
Cloud email security solution. **Plan 1** provides Safe Links, Safe Attachments, Anti-Phishing protection, and real-time detection analysis. **Plan 2** adds Threat Explorer, Automated Investigation and Response (AIR) playbooks, and Attack Simulation Training.
92. What is Microsoft Defender for Endpoint (MDE) and how does it integrate with M365?
Enterprise Endpoint Detection and Response (EDR) platform. Onboards endpoints to monitor behavioral telemetry, perform automated threat remediation, assess host vulnerabilities, and feed device risk scores directly into Entra ID Conditional Access.
93. Explain Data Loss Prevention (DLP) across Microsoft 365 workloads.
DLP policies monitor and prevent accidental exposure of sensitive info (SSNs, credit card numbers, trade secrets) across Exchange emails, Teams chat messages, SharePoint document libraries, OneDrive sync folders, and local Windows endpoints.
94. What is Microsoft Purview and what core security tools reside within it?
Unified data governance, risk management, and compliance suite. Residing portals include **Information Protection** (Sensitivity Labels), **Data Loss Prevention (DLP)**, **Data Lifecycle Management** (Retention), **Insider Risk Management**, and **eDiscovery**.
95. Explain Sensitivity Labels and Information Rights Management (IRM).
Labels (e.g., "Confidential", "Restricted") classify and protect data. IRM embeds persistent encryption metadata directly into file headers (Word, Excel, PDF), enforcing access restrictions (e.g., preventing printing, copying, or forwarding) wherever the file travels.
96. What is Microsoft Secure Score and how do you use it to improve security posture?
A measurement of an organization's security posture score (0-100%). Provides actionable recommendations (e.g., "Enable MFA for all users", "Turn on User Risk Policy") with assigned point values to guide security hardening.
97. What is Microsoft Compliance Manager and Compliance Score?
A tool in Microsoft Purview that measures organizational compliance against regulatory frameworks (ISO 27001, GDPR, HIPAA, NIST). Assigns a Compliance Score based on completed risk assessments and verified technical controls.
98. What are Retention Labels and Disposition Reviews in Microsoft Purview?
Retention Labels specify how long individual documents must be kept or deleted. **Disposition Reviews** create mandatory approval workflows requiring legal/records managers to review and formally authorize document destruction prior to permanent cloud purging.
99. How do you investigate and remediate phishing email alerts in Defender for Office 365?
- Open Defender portal → Incidents & alerts → Select alert.
- Analyze Threat Explorer to view email headers, SPF/DKIM verification, and user click logs.
- Trigger Automated Investigation and Remediation (AIR) playbook to soft-delete malicious emails from all tenant inboxes automatically.
- Revoke compromised user sessions and force password resets.
100. How do you secure Microsoft 365 users against cyber threats (End-to-End Security Baseline)?
Enforce mandatory MFA via Conditional Access, block legacy authentication, configure Defender for Office 365 (Safe Links/Attachments), enable Endpoint DLP, enforce Intune compliance policies with BitLocker and Defender EDR, configure SSPR, and run monthly phishing simulations.
Scenario 1: A user cannot sign in to Microsoft 365 even though the password is correct. How would you troubleshoot the issue?
- Check Microsoft Entra ID Sign-In logs: Search by User Principal Name (UPN) and filter status "Failure".
- Inspect exact error failure codes (e.g., account locked out, account disabled, password expired).
- Check **Conditional Access** evaluation tab: Verify if a policy is blocking sign-in due to an untrusted IP location, risky user flag, or non-compliant device state.
- Check MFA status: Verify if user's MFA authentication method is locked or waiting on a number matching prompt.
- Test web browser in Incognito mode to bypass corrupt local credential cache.
Scenario 2: Users are reporting that emails sent to an external domain are being rejected. Describe your troubleshooting process.
- Request exact Non-Delivery Report (NDR) / bounce code from affected users (e.g., `550 5.7.1 Service unavailable`).
- Run an Exchange Online **Message Trace** in EAC targeting the recipient domain to review outbound delivery events.
- Inspect tenant's **SPF, DKIM, and DMARC** DNS records using MXToolbox to verify proper configuration.
- Verify outbound IP reputation: Check if Exchange Online tenant IP is flagged on external DNS blocklists (RBLs).
- Review Exchange Transport Rules to verify no internal rule is blocking outbound messages.
Scenario 3: A shared mailbox is not visible in Outlook for one user but works for others. How would you investigate?
- Verify permissions in EAC: Confirm the user has **Full Access** and **Send As** delegated explicitly.
- Check automapping state: If permission was assigned via PowerShell, verify `AutoMapping` parameter was set to `$true`.
- Test OWA access: Guide user to log into Outlook Web → Open another mailbox → Type shared mailbox address. If OWA works, issue is local Outlook client.
- If OWA works but Outlook Desktop fails, disable Outlook Cached Exchange Mode for shared folders or recreate the user's local Outlook profile (`.ost` file).
Scenario 4: Microsoft Teams is showing "We're sorry—we've run into an issue" after login. What steps would you take to resolve it?
- Test login via Teams Web App (`teams.microsoft.com`) to isolate tenant/account issues from client app corruption.
- Quit Teams application completely from Windows taskbar.
- Clear local client cache by deleting contents under `%localappdata%\Packages\MSTeams_8wekyb3d8bbwe` (New Teams) or `%appdata%\Microsoft\Teams`.
- Check Credential Manager (`control keymgr.dll`): Remove cached Microsoft Teams and M365 authentication tokens.
- Relaunch Teams and complete fresh modern authentication / MFA prompt.
Scenario 5: OneDrive files are not syncing on multiple devices after a Windows update. How would you troubleshoot and restore synchronization?
- Check system tray OneDrive icon status (blue/gray cloud icon) for pause or credential error flags.
- Verify file path lengths do not exceed 400 characters and contain no illegal characters (`#`, `%`).
- Check if Windows Update modified group policies or proxy settings blocking sync ports (`443`).
- Reset OneDrive desktop application: Press `Win + R` → execute `%localappdata%\Microsoft\OneDrive\onedrive.exe /reset`.
- Re-link user account in OneDrive settings if reset fails.
Scenario 6: A newly created user can access Outlook but not Microsoft Teams or SharePoint. What checks would you perform?
- Check M365 Admin Center → Licenses: Expand user license details and verify **Microsoft Teams** and **SharePoint Header** service plan toggles are checked.
- Check Group-Based Licensing sync state if licenses are assigned via group.
- Verify Microsoft Teams app permission policies are assigned to the user in TAC.
- Check SharePoint site collection permissions to confirm user/group is granted membership access.
- Allow up to 24 hours for fresh provisioned tenant service propagation.
Scenario 7: A Conditional Access policy blocks users from accessing Microsoft 365 from personal devices. One executive needs temporary access. How would you handle the request securely?
- Do NOT disable the global Conditional Access policy or make the personal device fully compliant.
- Obtain formal approval from Information Security Lead following Change Management policy.
- Create an **Excluded Temporary Group** in Entra ID and add user account with a 24-hour expiration window.
- Configure the Conditional Access policy to enforce alternative security controls for this group (e.g., require MFA + enforce App Protection Policies / MAM in Intune to block file downloads to local personal storage).
- Audit group membership post-window to ensure account exclusion is removed promptly.
Scenario 8: Several users are repeatedly prompted for MFA despite successful authentication. How would you identify the root cause?
- Review Entra ID Sign-In logs for affected users: Filter by **Authentication Details**.
- Check if prompts are triggered by a **Conditional Access Policy** enforcing frequent session control sign-in frequency limits (e.g., re-authentication every 1 hour).
- Check for **Risky Sign-In** flags in Entra Identity Protection forcing continuous MFA re-validation due to IP velocity/tor network flags.
- Check if legacy apps are attempting connection without modern auth support.
- Clear cached OAuth tokens in Windows Credential Manager and re-register MFA methods if necessary.
Scenario 9: Azure AD Connect synchronization has stopped, and newly created on-premises users are not appearing in Microsoft Entra ID. What is your troubleshooting approach?
- Log onto Entra Connect server and open **Synchronization Service Manager** (`miisclient.exe`).
- Review the **Operations** tab for failed sync run tasks and exact error status strings.
- Test connector service account status: Ensure service account is not locked out in on-prem AD.
- Run manual delta synchronization via PowerShell: `Start-ADSyncSyncCycle -PolicyType Delta`.
- Inspect Event Viewer under `Application and Services Logs \ Azure AD Connect` for TLS / API connection failures to M365 endpoints.
Scenario 10: An employee accidentally deletes important files from SharePoint Online. Explain how you would recover the data and verify its integrity.
- Navigate to the affected SharePoint Site Collection → Open **Recycle Bin**.
- If files are present, select items and click **Restore** (restores back to original library location with version history intact).
- If empty, click **Second-stage Recycle Bin** link at the bottom of the page (accessible to Site Admins/M365 Admins) and restore items.
- If files were purged beyond 93 days, execute a **Content Search** in Microsoft Purview or restore from M365 backup solutions.
- Verify restored files open correctly and confirm version history remains intact.
Complete the 25 Microsoft 365 assessment questions below. Enter your full name and submit to calculate your score, view detailed explanations, and receive your official technical evaluation badge from Bora Academy.