Hotspot Question You have a Microsoft 365 subscription that contains three users named User1, User2, and User3 and an enterprise app named App1. The subscription contains the devices shown in the…

Question

Answer Area

• User1 can sign in to App1 from Device1.Yes
• User2 can sign in to App1 from Device2.Yes
• User3 can sign in to App1 from Device3.Yes

Explanation

This question tests understanding of how multiple Conditional Access policies interact, including include/exclude user group logic and access control grants vs. blocks when applied to specific resources.

Approach. When evaluating Conditional Access, all applicable policies are evaluated and the most restrictive result wins. Policy1 blocks access for Group1 members (unless they are in Group3, which is excluded). Policy2 grants access to App1 only if the device is compliant, applied to Group2 members. A user in both Group1 and Group2 would be blocked by Policy1 for all resources (since Block overrides Grant). A user only in Group2 would need a compliant device to access App1. A user in Group1 AND Group3 is excluded from Policy1 (Group3 exclusion takes precedence) and if also in Group2, only Policy2 applies requiring compliant device for App1. Always check: 1) Is the user in scope (included but not excluded)? 2) Is the resource in scope? 3) What is the access control result? Block always overrides Grant when both apply.

Concept tested. Microsoft Entra ID (Azure AD) Conditional Access policy evaluation - specifically how include/exclude group logic works, how Block access overrides Grant access when multiple policies apply to the same user and resource, and how device compliance requirements interact with policy assignments.

Reference. https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies

No community discussion yet for this question.