nerdexam
Microsoft

SC-300 · Question #156

Hotspot Question You have an Azure Active Directory (Azure AD) tenant: that contains the users shown in the following table. In Azure. AD Identity Protection, you configure a user risk policy that…

The correct answer is User1 can sign in from an anonymous IP address. = Yes; User2 can sign in from an anonymous IP address. = No; User3 can sign in from an anonymous IP address. = Yes. This question tests understanding of Azure AD Identity Protection policies, specifically how user risk and sign-in risk policies apply based on group membership and policy scope.

Submitted by emma.c· Mar 6, 2026Implement authentication and access management

Question

Hotspot Question You have an Azure Active Directory (Azure AD) tenant: that contains the users shown in the following table. In Azure. AD Identity Protection, you configure a user risk policy that has the following settings: Assignments: - Users: Group1 - User risk: Low and above Controls: - Access: Block access Enforce policy: On In Azure AD Identify Protection, you configure a sign-in risk policy that has the following settings: Assignments: - Users: Group2 - Sign-in risk: Low and above Controls: - Access: Require multi-factor authentication Enforce policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Answer Area

  • User1 can sign in from an anonymous IP address.Yes
  • User2 can sign in from an anonymous IP address.No
  • User3 can sign in from an anonymous IP address.Yes

Explanation

This question tests understanding of Azure AD Identity Protection policies, specifically how user risk and sign-in risk policies apply based on group membership and policy scope.

Approach. The user risk policy blocks access for members of Group1 when user risk is Low and above. The sign-in risk policy requires MFA for members of Group2 when sign-in risk is Low and above. A user in both groups would be subject to both policies. A user only in Group1 is blocked by the user risk policy but NOT required to do MFA by the sign-in risk policy. A user only in Group2 is required to do MFA on risky sign-ins but is NOT blocked by the user risk policy. Users in neither group are unaffected by both policies. The key principle is that each policy independently evaluates group membership: user risk policy applies ONLY to Group1 members, and sign-in risk policy applies ONLY to Group2 members. If a user is in Group1 only, they get blocked on risky sign-ins but are not subject to MFA requirements from the sign-in risk policy. If a user is in Group2 only, they must perform MFA on risky sign-ins but are not blocked by the user risk policy. If a user is in both groups, the more restrictive policy (block access from user risk policy) takes precedence when user risk is triggered.

Concept tested. Azure AD Identity Protection - User Risk Policy vs Sign-in Risk Policy, group-scoped policy assignments, and how overlapping or separate group memberships determine which controls (block access vs. require MFA) apply to specific users.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

Topics

#Identity Protection#user risk policy#sign-in risk policy#anonymous IP

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice