AZ-500 Question 1
Single answerYou are administering an Azure environment where a new web application needs to be restricted solely to members of the Finance department. Additionally, any Finance user accessing the app from outside the corporate network must complete multi-factor authentication (MFA). Which approach should you implement to best meet these requirements?
- A
A. Add all Finance users to an Azure AD security group, assign that group to the application, and create a Conditional Access policy that requires MFA for sign-ins from external networks.
- B
B. Set the app’s permission scope to ‘All users’ and enable Pass-through Authentication to enforce MFA during every sign-in attempt.
- C
C. Enable Azure AD Privileged Identity Management (PIM) for the Global Administrator role and require MFA for activation of that role.
- D
D. Configure a Conditional Access policy without specifying user groups, and only require MFA if a user signs in with a personal Microsoft account.
Show answer and explanation
Correct answer: A
Explanation
To meet the requirements of restricting access to a specific department while enforcing MFA outside a trusted network, follow Azure best practices by leveraging group-based application assignments and Conditional Access policies. Specifically, assign the application to a dedicated Azure AD group containing the Finance users and create a Conditional Access policy that triggers MFA for sign-ins originating outside the corporate IP range (listed as a named location). Further details on configuring Conditional Access policies and managing groups can be found in Microsoft documentation: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview.
- A. Correct.
A. Correct. By assigning the app to an Azure AD group containing only the Finance users, and configuring a Conditional Access policy to require MFA when sign-ins originate from outside the corporate network (e.g., a named location), you effectively restrict access to the Finance department and add an extra layer of security for external logins.
- B. Incorrect.
B. Incorrect. Setting the app’s permission to ‘All users’ does not restrict access to the Finance department. Pass-through Authentication alone does not address the specific requirement of MFA being triggered only for external sign-ins.
- C. Incorrect.
C. Incorrect. Enabling Azure AD PIM for the Global Administrator role is useful for privileged role management, but this does not enforce MFA specifically for the Finance users accessing the web application. It also does not handle departmental restrictions.
- D. Incorrect.
D. Incorrect. A Conditional Access policy that fails to specify the correct user group and only targets personal Microsoft accounts does not meet either the department restriction or the MFA requirement for corporate users accessing from external networks.