Hotspot Question You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table. You create and enforce an Azure AD Identity Protection sign-in risk policy…

Question

Exhibit

Answer Area

• When User1 signs in from an anonymous IP address, the user will:
  Be blockedBe prompted for MFASign in by using a username and password only
• When User2 signs in from an unfamiliar location, the user will:
  Be blockedBe prompted for MFASign in by using a username and password only

Explanation

This question tests understanding of Azure AD Identity Protection sign-in risk policies, specifically how Include/Exclude group assignments interact and what behavior each user experiences based on their group membership.

Approach. The policy includes Group1 and excludes Group2. A user in Group1 only will be subject to the policy and must complete MFA when sign-in risk is Low or above. A user in both Group1 and Group2 will be EXCLUDED from the policy (exclusions take precedence over inclusions), so they can sign in without MFA regardless of risk level. A user in neither group is not included in the policy scope, so they also sign in without the MFA requirement. A user in Group2 only is explicitly excluded, so they sign in without MFA enforcement. The key principle is: exclusions always override inclusions in Azure AD Identity Protection policies, and a user must be in the included group AND NOT in the excluded group to be subject to the policy controls.

Concept tested. Azure AD Identity Protection sign-in risk policy assignment logic - specifically how Include and Exclude group settings interact, where exclusions take precedence over inclusions, determining which users are subject to MFA requirements based on sign-in risk levels.

Reference. https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies

No community discussion yet for this question.