A company uses Microsoft 365. The company wants users to be prompted for additional verification when they access a federated third-party application. However, users must not be prompted for…

Conditional Access policies in Azure Active Directory allow administrators to configure specific conditions (like target application) and access controls (like requiring multi-factor authentication). This enables a policy to mandate additional verification for a federated third-party application while simultaneously excluding Microsoft Outlook from that requirement through separate policy configurations or exclusions.

Multi-factor authentication (MFA) is a security control that Conditional Access can enforce, but MFA alone does not provide the granular policy engine to apply verification selectively to specific applications while excluding others.

Active Directory Federation Services (AD FS) is an on-premises federation service, which while capable of identity management, doesn't provide the cloud-native, granular conditional access policy engine within Microsoft 365 needed to target specific cloud applications and exclude others as described.

Self-service password reset (SSPR) is a feature that allows users to reset their own passwords and has no direct relation to enforcing conditional multi-factor authentication requirements for accessing specific applications.