You have a Microsoft 365 E5 subscription that uses Teams. You need to ensure that users are prompted for multi-factor authentication (MFA) when they access Teams from outside the corporate network…

Question

Explanation

This question tests whether you know the correct policy type and administrative portal for enforcing location-based MFA in Microsoft 365. The scenario requires MFA only when users are outside the corporate network - a classic Conditional Access use case.

Approach. You should configure a Conditional Access policy (not legacy per-user MFA) because Conditional Access supports granular conditions such as named locations, device compliance, and specific applications like Teams. You would create a policy that targets the Microsoft Teams app, sets the condition to 'outside trusted/named locations' (representing the corporate network), and requires MFA as the grant control. The correct portal is the Microsoft Entra admin center (entra.microsoft.com - formerly Azure Active Directory admin center), under Protection > Conditional Access. Microsoft 365 E5 includes Azure AD Premium P2, which fully supports Conditional Access. The Teams admin center and Microsoft 365 admin center do not host Conditional Access policies.

Concept tested. Conditional Access policies in Microsoft Entra ID (Azure AD) - specifically configuring location-based MFA enforcement for cloud apps like Microsoft Teams using named locations and grant controls.

Reference. Microsoft Learn: 'What is Conditional Access?' - https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

No community discussion yet for this question.