A company deploys Microsoft 365. The company needs to deploy a solution that meets the following requirements: - allows access to Microsoft 365 only from corporate networks - allows access to…

Multi-factor authentication alone only addresses the additional verification requirement and cannot restrict access based on network location or device ownership.

Conditional Access is a policy-based engine in Azure AD that evaluates signals such as network location (named locations/corporate networks), device compliance state (corporate-owned/Intune-enrolled devices), and can enforce MFA as a grant control - all within a single unified policy. It is the only solution that natively combines all three requirements: location-based restrictions, device-based restrictions, and step-up authentication in one framework.

Azure Active Directory hybrid identity synchronizes on-premises identities to Azure AD but does not itself enforce network, device, or MFA access controls.

Self-service password reset allows users to reset their own passwords without IT intervention and does not address access restrictions or step-up authentication policies.