Microsoft 365 Certified: Administrator Expert Advanced Practice Exam: Hard Questions 2025

Your organization has a Microsoft 365 tenant with Exchange Online. A business unit acquires a smaller company that already has its own Microsoft 365 tenant. You must migrate mailboxes over a weekend with minimal user disruption and keep the acquired company’s SMTP domain usable throughout the transition. Users must be able to send/receive mail to the acquired domain during coexistence, and you want the least operational overhead. What is the best approach?

You administer a global Microsoft 365 tenant with multiple administrative teams. You need to allow a helpdesk group to manage Microsoft 365 Groups creation and membership, but you must prevent them from changing any Exchange transport settings, accessing security portals, or granting themselves additional roles. The solution must follow least privilege and be auditable. What should you implement?

Your tenant uses Microsoft Entra ID with Conditional Access. Executives travel frequently and require access to Exchange Online and SharePoint Online from unmanaged devices. You must enforce phishing-resistant MFA for executives on all access, but allow a break-glass path for emergency access without MFA. Additionally, legacy authentication must be blocked everywhere. Which design best meets the requirements?

Your organization uses Microsoft Entra Connect Sync. A subset of users must be cloud-only because they belong to a newly acquired division that cannot sync identities from the on-prem forest. However, those users must access on-premises resources using Kerberos/NTLM through Azure AD Application Proxy and must have a consistent UPN format across the organization. You want to avoid duplicate accounts and ensure a clean long-term identity strategy. What should you do?

You need to implement a Conditional Access design for a workforce using Windows, macOS, iOS, and Android. Requirements: (1) Only compliant devices can access SharePoint Online and Exchange Online, (2) Teams must still be accessible from unmanaged devices but only with limited access to files, and (3) You must minimize user prompts and avoid blocking service accounts used by automation. Which configuration best meets the requirements?

After enabling Microsoft Entra ID Protection risk-based policies, you notice frequent user risk detections triggering password reset for a specific group of developers who use automation and frequently sign in from ephemeral build agents. You must reduce false positives without weakening security for the rest of the tenant. What is the best remediation strategy?

Your security team observes an increase in Business Email Compromise (BEC). You want Microsoft 365 Defender to automatically contain the threat by disabling compromised user accounts and removing malicious inbox rules when high-confidence compromise is detected. However, you must avoid automated actions against a VIP pilot group until the SOC approves. What should you configure?

Microsoft 365 Defender is generating multiple incidents that appear unrelated: suspicious OAuth consent grants, unusual mailbox forwarding rules, and anomalous sign-ins. You suspect an attacker is using OAuth app abuse to persist and exfiltrate email. You need to (1) confirm scope quickly, (2) remove persistence, and (3) prevent recurrence with least disruption. Which action sequence is best?

You roll out Microsoft Defender for Endpoint and integrate with Microsoft 365 Defender. A subset of Windows devices shows as onboarded in Defender for Endpoint but does not appear in Microsoft 365 Defender incidents, and device-based alerts are missing from unified incidents. You must identify the most likely misconfiguration. What should you check first?

Your legal department requires that sensitive contracts stored in SharePoint Online and OneDrive are retained for 7 years and are immutable during retention. Additionally, when a contract reaches end-of-life, it must be disposed of only after a disposition review by Records Managers. Users must not be able to permanently delete or edit retained copies, even if they have site collection admin rights. Which Microsoft Purview solution best meets these requirements?