AZ-500 Question 16
Select 2You are an Azure administrator for Contoso Ltd. The company wants to enforce multi-factor authentication (MFA) for all employees when they sign in from locations outside the corporate office. However, they do not want employees in the corporate office to be repeatedly prompted for MFA. Your organization has Azure AD Premium P1 licenses. Which two steps should you implement in Azure AD to meet these requirements?
- A
Create a Conditional Access policy that requires MFA for sign-ins originating from named locations outside the corporate IP range.
- B
Enable Security Defaults in Azure AD to block any sign-ins from unknown locations without additional configuration.
- C
Configure a named location for the corporate office IP range and exclude it from the MFA requirement in the Conditional Access policy.
- D
Assign all end users the built-in 'Conditional Access Administrator' role to allow them to manage their own MFA settings.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements, you typically must create a Conditional Access policy that requires MFA specifically for sign-ins from outside trusted locations. You also configure a named location for your corporate network IP range and exclude it from the MFA requirement. This process minimizes MFA prompts for on-premises users while enforcing stronger authentication for external access. Refer to Microsoft documentation on Conditional Access (https://learn.microsoft.com/azure/active-directory/conditional-access/overview) and MFA (https://learn.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks) for detailed guidance.
- A. Correct.
Option 1 is correct. Conditional Access policies allow you to enforce MFA based on location. By specifying a condition for sign-ins from outside the corporate IP range, you can require MFA only for those sign-ins, fulfilling the requirement for stronger security.
- B. Incorrect.
Option 2 is incorrect. Enabling Security Defaults will enable a baseline level of MFA for all users, but it does not let you customize policies by location or exclude trusted IP ranges. This approach lacks the granularity to separate corporate-network sign-ins from external sign-ins.
- C. Correct.
Option 3 is correct. Configuring a named location for your corporate office IP range and excluding it within the Conditional Access policy ensures that users on the corporate network do not get repeatedly prompted for MFA, achieving the goal of minimizing disruptions inside the office.
- D. Incorrect.
Option 4 is incorrect. Granting all end users the 'Conditional Access Administrator' role would be a security risk and is not required to configure or use Conditional Access for MFA. Roles should be limited to administrators who need them.