Hotspot Question You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. You create and enforce an Azure AD Identity Protection sign-in risk policy…

Question

Exhibit

Answer Area

• When User1 signs in from an anonymous IP address, the user will:
  Be blockedBe prompted for MFASign in by using a username and password only
• When User2 signs in from an unfamiliar location, the user will:
  Be blockedBe prompted for MFASign in by using a username and password only
• When User3 signs in from an infected device, the user will:
  Be blockedBe prompted for MFASign in by using a username and password only

Explanation

This hotspot question tests understanding of Azure AD Identity Protection sign-in risk policies, including policy scope (inclusions/exclusions) and how MFA requirements interact with user configurations.

Approach. The policy applies to Group1 members EXCLUDING Group2 members. For users in scope (Group1 only, not Group2), when sign-in risk is Medium or above, they must complete MFA to gain access. User1 (in Group1, not Group2) is in scope - if their sign-in risk is Medium+, they are prompted for MFA; if risk is low/none, they sign in normally. User2 (in Group2) is explicitly excluded from the policy, so the risk policy does NOT apply regardless of risk level - they sign in without MFA enforcement from this policy. User3 (not in Group1 or Group2) is not included in the policy scope (policy includes Group1 only), so the policy also does NOT apply to them. The key distinctions are: inclusion by group membership, exclusion overriding inclusion, and that the MFA requirement only triggers at Medium risk level or above for in-scope users.

Concept tested. Azure AD Identity Protection sign-in risk policy scope and enforcement - specifically how Include/Exclude group assignments determine policy applicability, how risk level thresholds trigger access controls, and how MFA is enforced as a conditional access action for risky sign-ins.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

No community discussion yet for this question.