A company subscribes to Microsoft 365 and uses Azure Active Directory. Users are required to use a corporate computer and the Microsoft Authenticator app. The company wants to protect employee…

Cloud apps are a Conditional Access condition used to target specific applications for policy enforcement, not a signal that detects geographic location or risk associated with employees traveling internationally.

User risk is an Identity Protection signal integrated with Conditional Access that detects anomalous sign-in behavior, such as impossible travel or unfamiliar locations, which directly addresses protecting employees working outside their home country by flagging potentially compromised accounts.

Group membership is used to scope which users a Conditional Access policy applies to, not a signal that detects or responds to the geographic or risk context of a sign-in event.

Named locations allow administrators to define trusted or untrusted geographic regions (countries/regions) as Conditional Access signals, enabling policies that trigger additional controls or block access when users sign in from outside approved countries, directly addressing the international travel protection requirement.