MS-102 · Question #30
You have a Microsoft 365 E5 subscription. You need to create Conditional Access policies to meet the following requirements: - All users must use multi-factor authentication (MFA) when they sign in…
The correct answer is B. 4. To meet the five Conditional Access requirements, a minimum of four policies are needed by combining similar conditions and utilizing exclusions effectively.
Question
You have a Microsoft 365 E5 subscription. You need to create Conditional Access policies to meet the following requirements:
- All users must use multi-factor authentication (MFA) when they sign
in from outside the corporate network.
- Users must only be able to sign in from outside the corporate network
if the sign-in originates from a compliant device.
- All users must be blocked from signing in from outside the United
States and Canada.
- Only users in the R&D department must be blocked from signing in from
both Android and iOS devices.
- Only users in the finance department must be able to sign in to an
Azure AD enterprise application named App1. All other users must be blocked from signing in to App1. What is the minimum number of Conditional Access policies you should create?
Options
- A3
- B4
- C5
- D6
- E7
- F8
How the community answered
(47 responses)- A9% (4)
- B83% (39)
- C4% (2)
- E2% (1)
- F2% (1)
Why each option
To meet the five Conditional Access requirements, a minimum of four policies are needed by combining similar conditions and utilizing exclusions effectively.
3 policies would not be enough to cover all distinct requirements, especially the specific user group and app exclusions for App1 and specific device platforms.
Four policies are sufficient: one to enforce MFA and compliant devices for external access, one to block access from specific geographic locations, one to block specific device platforms for the R&D department, and one to block all users except the Finance department from accessing App1.
5 policies would be more than the minimum required, as the App1 requirement can be handled with a single policy using exclusions instead of two separate policies.
6 policies is excessive and implies over-segmentation or misunderstanding of how policies can be combined or use exclusions.
7 policies is significantly more than needed and indicates a lack of efficiency in policy design.
8 policies is far more than required and represents a complete misinterpretation of Conditional Access policy capabilities.
Concept tested: Designing Conditional Access policies efficiently
Source: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access
Topics
Community Discussion
No community discussion yet for this question.