Hotspot Question You have a Microsoft 365 E5 subscription that contains two groups named Group1 and Group2 and the users shown in the following table. The subscription contains a Conditional Access…

Question

Answer Area

• User1 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps.Yes
• User2 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps.No
• User3 must use multifactor authentication (MFA) when signing in to Microsoft 365 apps.Yes

Explanation

This question tests understanding of Conditional Access policy assignment logic in Microsoft Entra ID (Azure AD), specifically how Include/Exclude rules interact for users who belong to multiple groups or have specific roles.

Approach. Policy1 applies MFA to users in Group1 OR who have the Global Administrator directory role, EXCEPT those in Group2 (exclusions override inclusions). To determine if a user is affected: first check if they match any Include condition (member of Group1 OR is a Global Admin), then check if they are in the Exclude group (Group2) - exclusion wins. A user who is a Global Admin but also in Group2 would be EXCLUDED (no MFA required). A user in Group1 but also in Group2 would be EXCLUDED (no MFA required). A user in neither Group1 nor with a Global Admin role is NOT included at all (policy does not apply, so no MFA required from this policy). Only users who match an Include condition AND are NOT in Group2 will be required to perform MFA.

Concept tested. Microsoft Entra ID Conditional Access policy assignment logic: how Include and Exclude rules for users/groups/directory roles interact, with exclusions always taking precedence over inclusions.

Reference. https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups

No community discussion yet for this question.