Microsoft Certification 70-346 - O365 Identities/Requirements

The correct port to open between the AD FS proxy server and the AD FS federation server is TCP 443. This is because TCP port 443 is the default port for HTTPS communication, which is used for secure communication between web browsers and web servers. AD FS requires secure communication for authentication and authorization processes, and TCP 443 ensures that the communication is encrypted and secure.

To meet the requirement of not requiring multi-factor authentication for users signing in from the main office location, the administrator should configure an IP whitelist for the main office location. By doing this, the system will allow access without multi-factor authentication only from the specified IP addresses associated with the main office location. This ensures that users accessing resources from remote locations will still be required to verify their identity with a password and token, while users within the main office location will not be prompted for multi-factor authentication.

To support single sign-on in Office 365, two certificates need to be installed: Secure Sockets Layer (SSL) and Token signing. The SSL certificate is necessary for encrypting the communication between the user's browser and the Office 365 services, ensuring a secure connection. The Token signing certificate is used to sign the security tokens issued by the identity provider, allowing Office 365 to trust the authentication information provided by the identity provider. By installing both certificates, the environment will be able to establish a secure and trusted single sign-on experience for users.

All user accounts will be synchronized. The Windows Azure Active Directory Sync Tool will synchronize all user accounts, regardless of their password length. The password policies for on-premises Active Directory Domain Services (AD DS) and Office 365 user accounts are not relevant to the synchronization process.

Admin1 should be assigned the role of a global administrator. A global administrator has the highest level of permissions in Office 365 and can perform all administrative tasks, including resetting user passwords for administrators. This role provides the necessary permissions to fulfill the requirement of resetting user passwords for administrators.

To meet the requirements of a redundant AD FS implementation, a minimum of two AD FS servers is required. Each server would have a Windows Internal Database to store AD FS configuration data. Additionally, to achieve a custom login page for external users and single sign-on for internal users, a minimum of two Web Application Proxy (WAP) servers is needed. Therefore, a total of four servers should be deployed.

The subject name for the certificate should be fs.fabrikam.com. This is because fs.fabrikam.com is the fully qualified domain name (FQDN) that represents the federation servers in the Fabrikam, Inc. environment. The certificate needs to match the FQDN of the server where AD FS is installed in order to establish secure communication between the federation servers and other components of the Office 365 tenant.

Admin2 should be assigned the role of a "billing administrator" because they need to perform purchasing operations. The billing administrator role allows them to manage billing, subscriptions, and purchases for the organization. This role does not have excessive permissions beyond what is required for their specific task.

The correct role to assign to User2 is "global administrator" because User2 needs to be able to reset passwords for all administrator accounts, which includes User1. The other options (delegate administrator, billing administrator, password administrator) do not have the necessary permissions to reset passwords for all administrator accounts.

To support all Exchange Online features, you need to create two DNS entries: MX and CNAME. The MX (Mail Exchanger) record is used to specify the mail server responsible for accepting email messages on behalf of the domain. This record ensures that incoming emails are delivered to the correct server. The CNAME (Canonical Name) record is used to create an alias for a domain name. In this case, it is used to create an alias for the Autodiscover service, which is required for various Exchange Online features such as automatic configuration of email clients.

Admin3 should be assigned the role of "user management administrator". This role will provide the necessary permissions to create and manage user views, which is the assigned task for Admin3. The other roles, such as billing administrator and global administrator, do not align with the specific tasks mentioned in the requirements.

To ensure that all users can access the services available in their regions, you should update the user location settings. By configuring the user location settings, you can specify the region or country for each user in the Office 365 environment. This allows the services to be localized and tailored to the specific needs and regulations of each region, ensuring that users have access to the appropriate services based on their location.

The Microsoft Remote Connectivity Analyzer Tool is used to test the connectivity and functionality of various Office 365 services, including Exchange Online. In this scenario, the tool can be used to check if User1 and User2 can share their free/busy information, ensuring that they can view each other's availability. By running the appropriate tests in the tool, the administrator can verify the configuration and troubleshoot any issues that may prevent the free/busy information from being shared.

To ensure that User1 can assign administrative roles to other users, User1 needs to have the highest level of administrative privileges, which is the global administrator role. By creating an Office 365 tenant and assigning User1 the global administrator role, User1 will have the necessary permissions to manage Office 365 delegation for the company.

The Office 365 Enterprise E3 plan allows for a maximum of 25 trial users. This plan would be the best choice as it provides the highest number of trial users compared to the other options.

The current status of Exchange Online is available but the service is degraded. This means that while Exchange Online is still accessible, there may be some performance issues or limitations in its functionality. On the other hand, SharePoint Online is available without any reported issues.

To prepare the environment for AD FS setup, the first action is to configure Active Directory to use the domain "contoso.com". This ensures that the AD FS server is integrated with the correct Active Directory domain.

The second action is to create a server authentication certificate for the federation server. This certificate should have "fs.contoso.com" as the subject name and subject alternative name. This certificate is necessary for secure communication between the AD FS server and Office 365 services, enabling SSO functionality.

not-available-via-ai

Adding the cluster DNS name and IP address of the federation server farm to the hosts file on both FS1 and FS2 ensures that name resolution is configured correctly for both servers. The hosts file is a local file on each server that maps hostnames to IP addresses, allowing the servers to resolve the DNS name of the federation server farm to the correct IP address. By adding the cluster DNS name and IP address to the hosts file on both servers, name resolution will be consistent and reliable for the deployment of Active Directory Federation Services (AD FS) on Windows Server 2012.

The Get-MSOLUser cmdlet is used to retrieve information about users in Azure Active Directory, including their assigned licenses. By using this cmdlet, you can identify which users do not have a Microsoft Exchange Online license assigned to their user account.

The Microsoft Online Services Sign-in Assistant is required for Office Professional Plus to authenticate and connect to the Office 365 services. By installing the Sign-in Assistant, User1 will be able to save and edit Office documents on the client computer again. Reinstalling Office Professional Plus or upgrading the subscription to Plan E4 would not address the issue, and installing the Office Customization Tool is not necessary for resolving this specific problem.

The on-premises Active Directory is where the department attribute for the employee should be changed. The Windows Azure Active Directory Sync tool synchronizes the on-premises Active Directory with Office 365 services, so any changes made to the on-premises Active Directory will be reflected in Office 365. Therefore, updating the department attribute in the on-premises Active Directory will ensure that the new department information is displayed in all Office 365 services for the employee.

not-available-via-ai

The correct role to assign to User1 is "password administrator" because User1 needs to be able to reset passwords for standard user accounts and other members of the same role, but must not reset passwords for other administrator accounts. This role allows User1 to manage passwords for specific user accounts without having the ability to access or modify other administrative settings.

The domain names "contoso" and "contoso.local" should be excluded from the migration. "contoso" is likely the internal domain name used within the local network and does not need to be migrated to Office 365. "contoso.local" is also an internal domain name commonly used for Active Directory domains and does not need to be migrated either. The domain names "contoso.us" and "contoso.co" should be included in the migration as they are likely the public domain names that need to be configured for email and Lync Online services in Office 365.

The Microsoft Connectivity Analyzer tool is a useful tool for troubleshooting connectivity issues in Office 365. By using this tool, the administrator can test the Lync settings and determine if there are any issues with the configuration that may be preventing users from signing in to Lync on their mobile devices. This tool can help identify any network or configuration issues that may be causing the problem and provide recommendations for resolving them. Therefore, using the Microsoft Connectivity Analyzer tool to confirm settings is the appropriate action to take in this scenario.

To resolve the issue of users in the New York office being unable to transfer files to users in the San Francisco office using Lync Online, the correct solution is to configure the firewall to open Transmission Control Protocol (TCP) ports 50040-50059. By opening these specific ports, it allows the necessary network traffic for file transfers between the two offices to pass through the firewall. This will enable the users to successfully transfer files using Lync Online without the need for a private network connection or upgrading the Lync Online clients.

To ensure that a custom domain name is used in Office 365 for email services, the first step should be to add the custom domain name to Office 365 and then verify it. This allows the company to establish ownership and control over the domain name. Once the domain is added and verified, the necessary DNS records can be created, such as MX records for email routing or CNAME records for domain aliasing. However, these DNS records can only be set up after the domain has been added and verified in Office 365.

not-available-via-ai

You should use Active Directory Users and Computers to delete the user account and its associated mailbox. This tool allows you to manage user accounts and mailboxes in an on-premises Active Directory environment. Since the user accounts are hosted on-premises and not in Office 365, using this tool would be the appropriate choice for deleting the user account and mailbox.

The correct answer is "Get-MsolUser -All -UnlicensedUsersOnly | Remove-MsolUser -Force". This command will retrieve all user accounts in Office 365, including those without any licenses assigned, and then remove them using the "Remove-MsolUser" cmdlet. The "-Force" parameter is used to bypass any confirmation prompts and delete the user accounts without further intervention. This command ensures that only the unlicensed user accounts are removed, minimizing the administrative effort required.

To use the bulk add tool to add users to Office 365, you need to include the User Name and Display Name fields in the file. The User Name field is necessary to uniquely identify each user, while the Display Name field is used to show the user's name in the Office 365 interface. Including these fields ensures that the users are properly identified and displayed within the Office 365 system. The other fields mentioned (First Name, Last Name, and Job Title) may be helpful for additional user information, but they are not specifically required for the bulk add process.

To determine the organization's readiness for the Office 365 implementation, the best option is to run the OnRamp for Office 365 tool. This tool provides comprehensive information about the current environment and helps gather all the necessary requirements for the implementation. It is specifically designed for Office 365 deployments and will provide the most accurate assessment of the organization's readiness.

The correct Windows PowerShell command to enforce password complexity requirements for all accounts is "Get-MsolUser | Set-MsolUser -StrongPasswordRequired $true". This command retrieves all users using the Get-MsolUser cmdlet and then sets the StrongPasswordRequired property to true for each user using the Set-MsolUser cmdlet. This ensures that all users are required to have a strong password.

To add the label "external" to the subject line of each email message received from an external sender, you need to create a new rule in the Exchange Control Panel. The New Rule wizard allows you to set conditions and actions for incoming emails, including adding a label to the subject line. This can be done by selecting the option to add a condition for messages received from external senders and then selecting the action to add the label "external" to the subject line.

The maximum amount of days that can be set before a password change is forced is 730. This means that users will have up to 2 years before they are required to change their passwords. This setting allows for longer periods of password validity, addressing the issue of passwords expiring too frequently. Additionally, users will receive password expiration notifications as early as possible, giving them ample time to change their passwords before they expire.

The Microsoft Remote Connectivity Analyzer is the correct answer because it is a tool that allows you to test and verify the functionality of various Office 365 services, including single sign-on. By running the analyzer, you can ensure that users are able to successfully authenticate and access Office 365 resources from the internet.

To update the password policy for a specific user in Office 365 without impacting any other accounts, the correct PowerShell cmdlet to run is "Set-MsolUser". This cmdlet allows the Office 365 administrator to modify user properties, including the password policy. By using this cmdlet, the administrator can set the password for User1 to never expire, as required in the scenario.

The first three things that should be installed are .NET Framework 3.5 with Service Pack 1, AD FS 2.0, and Rollup 3 for AD FS 2.0. Installing .NET Framework 3.5 with Service Pack 1 is necessary as it is a prerequisite for AD FS 2.0. AD FS 2.0 is required for single sign-on functionality. Rollup 3 for AD FS 2.0 is important to ensure that any necessary updates and fixes are applied to AD FS 2.0.

You should install and configure the Web Server (IIS) role and the AD FS role. The Web Server (IIS) role is required to host the AD FS proxy server. The AD FS role is necessary to set up and configure the AD FS service, which allows for single sign-on authentication and authorization across different applications and systems. The other roles listed are not directly related to the installation and configuration of an AD FS proxy server.

The earliest amount of time that can be set for users to be notified of an upcoming password change is 30 days. This means that users will receive a notification 30 days before their password is set to expire, giving them ample time to change their password before it becomes inactive. This setting allows for a longer duration for active passwords and ensures that users are adequately notified of the upcoming change.

The SSL certificate is used to secure the communication between federation servers, clients, and federation server proxy computers. SSL (Secure Sockets Layer) is a protocol that provides secure communication over a computer network. It encrypts the data transmitted between the client and the server, ensuring that it cannot be intercepted or tampered with by unauthorized parties. In the context of Active Directory Federation Services, the SSL certificate is necessary to establish a secure trust between the on-premises Active Directory domain and the Office 365 environment.

To analyze trends for the email messages received over the past 60 days and determine the reason for the increase in spam messages, the Office 365 administrator should view the mail protection reports. These reports provide insights into the effectiveness of the mail protection features, including information on spam messages, malware detections, and other security-related metrics. By analyzing these reports, the administrator can identify patterns, trends, and potential issues that may be causing the increase in spam messages.

To prevent users from changing their user display name using Outlook Web App, you should modify the default role assignment policy. By modifying the default role assignment policy, you can restrict the permissions for users to modify their display name. This will ensure that users do not have the ability to change their display name using Outlook Web App.

To prepare to install the Windows Azure Active Directory Sync tool, you need to perform two actions. First, you should install Microsoft .NET Framework 3.5 SP1 and Microsoft .NET Framework 4.0 on the domain controller. This is necessary because the Azure Active Directory Sync tool requires these frameworks to run properly. Second, you should raise the forest functional level to Windows Server 2008 R2. This is required because the Azure Active Directory Sync tool is not compatible with lower forest functional levels. By performing these two actions, you will ensure that the domain controller is ready for the installation of the Azure Active Directory Sync tool and that user attributes can be synchronized from the on-premises Active Directory Domain Services environment to Office 365.

To import the new user accounts into both the local Active Directory and Office 365, a Windows PowerShell script should be created to import account data from the file into Active Directory. This script will allow for the automation of the import process, ensuring that the new user accounts are created in both systems on a daily basis. Using the Office 365 admin center or the Windows Azure Management Portal would not provide the necessary functionality to import the data into Active Directory. Additionally, using the MSOnline module in the Windows PowerShell script will allow for the import of account data into Office 365 as well.

To enable multi-factor authentication for Office 365, the first action is to enable it for all user accounts. This ensures that all users will be required to go through the multi-factor authentication process. The second action is to instruct users to obtain a single-use password to complete the registration process. This ensures that users have a unique password that they can use during the registration process. The third action is to instruct users to use a mobile phone to complete the registration process. This ensures that users have a mobile device that they can use for the multi-factor authentication process.

To add a custom domain name to Office 365, the first step is to connect to Windows Azure Active Directory. This allows you to manage the domain settings. Then, you need to run the Windows PowerShell cmdlet New-MsolDomain. This cmdlet is used to add the custom domain to Office 365. Finally, you should install the Windows Azure Active Directory module for Windows PowerShell. This module provides the necessary tools and commands to manage the Azure Active Directory.

The correct answer is to configure a CNAME record with the hostname "www.contoso.com" and point it to "contoso-public.sharepoint.com". This is because a CNAME record is used to create an alias for a domain name, allowing multiple domain names to point to the same location. In this case, the custom domain "www.contoso.com" needs to point to the public-facing SharePoint site, which is hosted at "contoso-public.sharepoint.com".

The correct answer is "The Remote Connectivity Analyzer with the Office 365 tab selected." This tool allows you to test the connectivity and configuration between Office 365 and the on-premises Exchange Server. By selecting the Office 365 tab, you can specifically troubleshoot the issue of users not being able to access free/busy information from both Office 365 and Exchange Server 2013.