Microsoft 365 Certified: Administrator Expert Intermediate Practice Exam: Medium Difficulty 2025

Your organization is acquiring a smaller company. You need to add their domain (contoso-acquired.com) to your Microsoft 365 tenant and move users over with minimal sign-in disruption. The acquired company currently uses its domain for email in another system. What should you do first in Microsoft 365 to begin the domain onboarding process correctly?

Your company has multiple departments and wants each department’s helpdesk staff to manage passwords and basic user properties only for their department. You must ensure they cannot manage groups, roles, or users outside their department. Which approach best meets the requirement?

You are implementing Conditional Access. A subset of users (finance) must always use phishing-resistant MFA when accessing Microsoft 365 from unmanaged devices, but can use standard MFA from compliant corporate devices. Which solution best satisfies this requirement?

You need to grant an external consultant access to a SharePoint Online site for 30 days. Access must automatically expire, and the consultant should authenticate using their own identity provider. Which Microsoft 365 feature should you use?

You want to reduce the risk of users consenting to malicious OAuth apps. The security team requires that only a designated group can approve third-party app consent requests, and all other users must be blocked from granting consent. What should you configure?

Microsoft 365 Defender flags a potential phishing campaign targeting multiple users. You want to identify all users who clicked the malicious URL and automatically remediate by isolating affected devices if a related malware alert is also present. Which Microsoft 365 Defender capability best supports this end-to-end scenario?

A user reports that legitimate emails from a partner are being quarantined as spam. You need to investigate in Microsoft 365 Defender, determine why the messages were quarantined, and allow future messages with minimal risk. What should you do first?

Your SOC wants to ensure that high-severity alerts in Microsoft 365 Defender automatically create incidents in a third-party ITSM tool and include key entities (user, device, mailbox) for triage. Which approach is most appropriate?

Your organization must retain all Teams chat messages for 7 years for regulatory reasons, but allow users to delete messages from their view. You need to implement this with minimal administrative overhead and ensure retention applies to all users. What should you configure in Microsoft Purview?

You need to prevent users from sharing documents that contain national ID numbers outside the organization. If sharing is attempted, users should see a policy tip and be able to override only with a business justification. Which solution should you implement?