Free guides, interview Q&As, and job responsibility breakdowns — curated by industry veterans to help you crack MNC interviews
Multi-Factor Authentication (MFA)
Definition: A security mechanism requiring two or more forms of verification before granting account access.
Day-to-Day Example: Like needing both a physical key and a fingerprint scan to open a safe — a stolen key alone isn't enough.
Something You Know
Definition: An authentication factor based on private information only the user should know, like a password or PIN.
Day-to-Day Example: Like the secret combination to a padlock, known only to the owner.
Something You Have
Definition: An authentication factor based on a physical device the user possesses, like a phone or hardware token.
Day-to-Day Example: Like a physical hotel key card that must be tapped, regardless of whether you know the room number.
Something You Are
Definition: An authentication factor based on unique biometric traits, like a fingerprint or face scan.
Day-to-Day Example: Like a fingerprint lock that only opens for the one person whose print is registered.
Microsoft Authenticator App
Definition: Microsoft's recommended MFA app, which sends a sign-in approval notification directly to the user's registered device.
Day-to-Day Example: Like a doorman calling your phone to confirm it's really you before buzzing you into the building.
Passwordless Authentication
Definition: A sign-in method where users authenticate via the Microsoft Authenticator app without entering a password at all.
Day-to-Day Example: Like unlocking your phone with just your face, skipping the passcode entirely.
MFA Registration
Definition: The process where a user sets up their chosen verification method the first time MFA is enabled for their account.
Day-to-Day Example: Like registering your fingerprint with a new phone before the fingerprint unlock feature will actually work.
MFA Status: Disabled
Definition: A state where MFA is not configured, and the user signs in using only a password.
Day-to-Day Example: Like a door with only a regular lock and no additional security system installed.
MFA Status: Enabled
Definition: A state where MFA is turned on for a user, but they may not have completed registering their verification method yet.
Day-to-Day Example: Like a security system that's been installed but not yet activated by the homeowner.
MFA Status: Enforced
Definition: A state where MFA is fully configured and required every time the user signs in.
Day-to-Day Example: Like a security system that's installed, activated, and armed — fully operational.
Distribution List (DL)
Definition: A mail-enabled group used purely for email communication, delivering messages sent to one address to every member.
Day-to-Day Example: Like a household's shared physical mailbox — one address, but every family member gets to read what arrives.
Distribution List Owner
Definition: A user assigned to manage a Distribution List's membership and settings.
Day-to-Day Example: Like the person responsible for updating a neighborhood newsletter's mailing list when people move in or out.
Dynamic Distribution List (DDL)
Definition: A mail-enabled group whose membership is automatically calculated from user attributes and recipient filters, rather than manually maintained.
Day-to-Day Example: Like a smart mailing list that automatically adds anyone who moves into a certain neighborhood and removes them once they move out.
Recipient Filter
Definition: The rule or condition (e.g., Department = HR) that determines which users automatically belong to a Dynamic Distribution List.
Day-to-Day Example: Like a standing instruction to a mail carrier: "deliver to anyone currently living at addresses on Elm Street," updated automatically as residents change.
User Attribute
Definition: A stored property of a user account, such as Department, Job Title, or Office Location, used by DDL filters to determine membership.
Day-to-Day Example: Like the details on an employee's ID badge — department, title, and office — that a system can read to sort people automatically.
Exchange Online
Definition: Microsoft's cloud-based email service that processes and delivers messages for Microsoft 365, including to Distribution Lists and DDLs.
Day-to-Day Example: Like the postal sorting facility that reads addresses and routes every letter to the right destination.
Exchange Admin Center
Definition: The dedicated management portal (admin.exchange.microsoft.com) for configuring Exchange Online features like Dynamic Distribution Lists.
Day-to-Day Example: Like a specialized back-office counter at the post office specifically for setting up complex mail-routing rules.
Security Administrator
Definition: An administrative role capable of managing security-related settings, including enabling MFA for users.
Day-to-Day Example: Like a building's dedicated security manager, responsible for badges and access control but not everything else in the building.
Authentication Administrator
Definition: An administrative role focused specifically on managing authentication methods, including MFA configuration.
Day-to-Day Example: Like a specialist locksmith brought in just to manage and reset how doors get unlocked, not general building management.
Verification Code
Definition: A temporary, one-time code generated or sent to a user that must be entered as the second MFA factor.
Day-to-Day Example: Like a one-time entry code texted to a guest for a single, time-limited use at a security gate.
1. Distribution List vs. Microsoft 365 Group
Feature Distribution List Microsoft 365 Group Email communication Yes Yes Shared mailbox No Yes Shared calendar No Yes Teams integration No Yes SharePoint site No Yes
2. Distribution List vs. Dynamic Distribution List
Feature Distribution List Dynamic Distribution List Membership management Manual Automatic Member addition Administrator adds users Based on recipient filter rules Member removal Manual Automatic Administrative effort High Low Best suited for Small, stable teams Large, frequently changing organizations
3. MFA Status: Disabled vs. Enabled vs. Enforced
Status Meaning Disabled MFA is not configured; user signs in with password only Enabled MFA is turned on but registration may not be completed yet Enforced MFA is fully configured and required at every sign-in
4. Something You Know vs. Something You Have vs. Something You Are
Factor Type Examples Something You Know Password, PIN, security question Something You Have Mobile phone, hardware token, Authenticator app Something You Are Fingerprint, facial recognition, iris scan
5. Microsoft Authenticator App vs. SMS Verification
Feature Microsoft Authenticator App SMS Verification Method Push notification approval on registered device One-time code sent via text message Security level Higher — Microsoft's recommended method Lower — vulnerable to SIM-swap attacks Requires Smartphone with the app installed Any phone capable of receiving SMS
6. Global Administrator vs. Authentication Administrator (for MFA)
Role MFA-Related Capability Global Administrator Full control, including enabling/resetting MFA for any user Authentication Administrator Focused specifically on managing authentication methods, including MFA
7. Exchange Admin Center vs. Microsoft 365 Admin Center (for Groups)
| Feature | Microsoft 365 Admin Center | Exchange Admin Center |
|---|---|---|
| Used for | Standard groups: Microsoft 365 Group, Security Group, Distribution Group | Dynamic Distribution Groups and advanced mail settings |
| Access URL | admin.microsoft.com | admin.exchange.microsoft.com |
8. Manual Member Addition vs. Recipient Filter
Feature Manual Member Addition (DL) Recipient Filter (DDL) How membership is set Admin selects each individual user A rule based on user attributes (e.g., Department = HR) Stays current automatically? No — requires manual updates Yes — recalculated at send time
9. Department-Based Filter vs. Location-Based Filter (DDL)
Filter Type Example Typical Use Case Department-Based Filter Department = HR Department-wide announcements Location-Based Filter Office = Mumbai Office/location-specific updates Job Title Filter Title = Manager Leadership-only communications
10. MFA Sign-In vs. Passwordless Sign-In
Feature Standard MFA Sign-In Passwordless Sign-In Password required? Yes, plus a second factor No password entered at all Method Password + Authenticator/SMS/Call Authenticator app approval only User experience Two distinct steps Single streamlined approval
Q1. What is Multi-Factor Authentication, and why is it needed?
Answer: MFA requires two or more forms of verification before granting access; it's needed because passwords alone can be stolen through phishing, malware, brute-force attacks, or data breaches, and a stolen password alone shouldn't be enough to get in.
Q2. What are the three categories of authentication factors used in MFA?
Answer: Something You Know (password/PIN), Something You Have (phone/token), and Something You Are (biometrics like fingerprint or face scan).
Q3. What does Microsoft typically combine for MFA in Microsoft 365?
Answer: Microsoft 365 typically combines a password (something you know) with a mobile-based verification method like the Authenticator app (something you have).
Q4. What are the steps in a typical MFA sign-in flow?
Answer: The user enters username and password, Microsoft verifies the credentials, a second authentication request is triggered, the user completes that verification, and access is granted.
Q5. What MFA methods does Microsoft 365 support?
Answer: Microsoft Authenticator app notifications, verification codes, SMS verification, voice call verification, and passwordless authentication via the Authenticator app.
Q6. What is the difference between MFA states Disabled, Enabled, and Enforced?
Answer: Disabled means no MFA at all (password only); Enabled means MFA is turned on but registration may not be complete; Enforced means MFA is fully configured and required at every sign-in.
Q7. What permissions are needed to enable MFA for a user?
Answer: The administrator needs the Global Administrator, Security Administrator, or Authentication Administrator role.
Q8. What should be done if a user loses access to their Authenticator app (e.g., lost phone)?
Answer: An administrator can reset the user's MFA settings, which requires the user to complete registration again with a new device or method.
Q9. What is a Distribution List, and what is its primary purpose?
Answer: A Distribution List is a mail-enabled group used purely for email communication — sending one email to the group's address delivers it to every member's mailbox.
Q10. What is the key difference between a Distribution List and a Microsoft 365 Group?
Answer: A Distribution List only handles email communication, while a Microsoft 365 Group additionally provides a shared mailbox, calendar, Teams integration, and a SharePoint site.
Q11. What permissions are required to create a Distribution List?
Answer: The administrator needs the Global Administrator role or the Exchange Administrator role.
Q12. What is a Dynamic Distribution List, and how does its membership work?
Answer: A Dynamic Distribution List automatically determines its membership using recipient filters based on user attributes (like Department), rather than requiring an admin to manually add each member.
Q13. What common attributes are used to define Dynamic Distribution List membership?
Answer: Department, Company, Office Location, Job Title, and Country/Region, along with custom attributes if needed.
Q14. Why is DDL membership described as "always up to date"?
Answer: Because membership is recalculated at the moment an email is sent, based on current attribute values, so employees are automatically included or excluded as their attributes change, with no manual updates needed.
Q15. Where are Dynamic Distribution Lists managed, and why is that different from standard groups?
Answer: DDLs are managed through the Exchange Admin Center (admin.exchange.microsoft.com) rather than the standard Microsoft 365 Admin Center Groups section, since they rely specifically on Exchange Online recipient filters.
Q1. An attacker obtains an employee's password through a phishing email but still can't sign in to their Microsoft 365 account. What security feature likely stopped them?
Answer: Multi-Factor Authentication (MFA) likely stopped them, since the attacker had the password but lacked the registered device or app needed to complete the second verification step.
Q2. An organization wants to enable MFA for its remote employees and administrators specifically, prioritizing the most secure method available. Which method should they recommend?
Answer: They should recommend the Microsoft Authenticator app, since it's Microsoft's recommended MFA method and is generally more secure than SMS or phone call verification.
Q3. A user recently switched to a new phone and can no longer receive their MFA approval notifications. What should be done to restore their access?
Answer: An administrator should reset the user's MFA registration, allowing the user to re-register MFA using their new device the next time they sign in.
Q4. A company wants to send a single email that reaches all 50 employees in its HR department, without needing shared mailboxes, calendars, or Teams integration. What should they create?
Answer: They should create a Distribution List (e.g., hr@company.com), since it's designed purely for email communication without the extra collaboration features of a Microsoft 365 Group.
Q5. A large company with 500 employees is tired of manually updating its HR distribution list every time someone joins, leaves, or transfers departments. What should they implement instead?
Answer: They should implement a Dynamic Distribution List with a filter like Department = HR, so membership updates automatically based on each employee's Department attribute, with no manual maintenance.
Q6. An employee transfers from the Delhi office to the Mumbai office, and their Office Location attribute is updated accordingly. What happens to their membership in location-based Dynamic Distribution Lists?
Answer: They are automatically removed from the Delhi-based DDL and automatically added to the Mumbai-based DDL, since DDL membership is recalculated from current attribute values whenever email is sent.
Q7. A company wants all managers across every department to receive leadership-specific announcements, regardless of which department they belong to. What should be configured?
Answer: A Dynamic Distribution List should be configured with a Job Title filter (e.g., Title = Manager), so any employee whose job title matches automatically receives the leadership communications.
Q8. An administrator wants to create a Dynamic Distribution List but can't find the option in the standard Microsoft 365 Admin Center Groups section. Where should they go instead?
Answer: They should go to the Exchange Admin Center (admin.exchange.microsoft.com) and navigate to Recipients → Groups, since Dynamic Distribution Groups are managed there rather than in the standard Admin Center.
