A company is evaluating Microsoft Azure Conditional Access policies. You reed to determine which scenarios Conditional Access policies support. Which three scenarios should you select? Each correct…

Question

Options

• AMulti-factor authentication
• BSelf-service password reset capabilities
• CHybrid Azure Active Directory joined device
• DBlocked access to Microsoft 365 services for unverified users
• EBitLocker deployment

• A
  90% (19)
• B
  5% (1)
• E
  5% (1)

Explanation

Azure Conditional Access Policies Explained

Azure Conditional Access acts as a policy engine that evaluates signals (user, location, device, app) and enforces access controls based on defined conditions. Option A (MFA) is correct because Conditional Access can require multi-factor authentication as a grant control when specific conditions are met (e.g., risky sign-ins or access from unknown locations). Option C (Hybrid Azure AD joined devices) is correct because Conditional Access can enforce device compliance by requiring that devices be Hybrid Azure AD joined before granting access. Option D (Blocked access to Microsoft 365) is correct because Conditional Access explicitly supports blocking access entirely for users who don't meet verification requirements, such as unverified or non-compliant users.

Options B and E are incorrect because Self-Service Password Reset (SSPR) is a separate Azure AD feature unrelated to access policy enforcement, and BitLocker is a Windows disk encryption tool managed through Intune/Endpoint Manager - neither falls within the scope of Conditional Access policy controls.

Memory Tip:

Think of Conditional Access as a "if-then" gatekeeper: IF a user meets certain conditions, THEN require MFA, block access, or demand a compliant/hybrid-joined device. Anything outside of authentication and access control (like encryption or password resets) belongs to different tools.

No community discussion yet for this question.