220-1102 Question 655
Single answerAssigned usersA technician is preparing several Windows 10 Pro laptops for a sales team. Each laptop will be shared by multiple employees across different shifts, but management wants only the assigned salesperson for each device to be able to sign in locally and access company apps. Which action should the technician take to BEST meet this requirement?
- A
Create a local standard account for every employee on every laptop
- B
Join each laptop to the domain or Entra ID and assign permissions so only the designated user account can sign in to that device
- C
Configure a single shared local administrator account and give the password only to the assigned salesperson
- D
Enable the Guest account and restrict access to the Sales folder with NTFS permissions
Show answer and explanation
Correct answer: B
Explanation
For assigned-user scenarios, best practice is to associate each device with a specific managed user account and control sign-in through centralized identity management, such as Active Directory or Microsoft Entra ID. This aligns with the security principles of least privilege, accountability, and easier lifecycle management. Creating many local accounts or using shared credentials makes auditing and access control difficult. Microsoft documentation and standard enterprise security guidance recommend using individual user accounts and centrally managed authentication rather than shared local administrative accounts for business endpoints.
- A. Incorrect.
This would allow many users to sign in to every laptop, which is the opposite of the requirement. It also increases administrative overhead and leaves unnecessary accounts on devices. While standard accounts are safer than administrator accounts for daily use, creating accounts for all employees on all laptops does not enforce assigned-user access.
- B. Correct.
This is correct. In an organizational environment, the best approach is to use centrally managed identities such as Active Directory domain accounts or Microsoft Entra ID accounts and configure the device so only the designated user is allowed to sign in. This supports the concept of assigned users by tying device access to a specific managed account, improves accountability, and simplifies revocation if the device assignment changes.
- C. Incorrect.
A shared local administrator account is a poor security practice. It removes accountability because multiple people could use the same credentials, and it grants elevated privileges unnecessarily. Assigned-user scenarios should use individual user identities with least privilege, not a shared admin account.
- D. Incorrect.
The Guest account is not appropriate for controlled business access and does not ensure that only a specific assigned user can sign in. NTFS permissions on a folder control file access, not who is permitted to log on to the laptop. Someone could still sign in and access other parts of the system.