AZ-500 Question 19
Select 2Your organization has multiple Azure AD–integrated applications. You plan to enforce multi-factor authentication (MFA) for all administrative sign-ins but need to ensure a service account (used by a scheduled automation script) is not affected. Which TWO Conditional Access configurations accomplish this requirement?
- A
Include all users in a single Conditional Access policy but explicitly exclude the service account. Under Grant, select 'Require multi-factor authentication.'
- B
Enable multi-factor authentication only for the service account and exclude all administrator accounts from the MFA requirement.
- C
Create a new Conditional Access policy that includes solely trusted IP ranges and applies 'Require multi-factor authentication' as a Grant control to all accounts, including the service account.
- D
Use a separate policy specifically for the service account, limiting it to modern authentication clients and setting it not to require MFA under Grant control.
Show answer and explanation
Correct answers: A, D
Explanation
In Azure AD Conditional Access, you can create multiple policies or a single inclusive policy to enforce different requirements for different user types. Excluding service accounts from MFA is a common practice when those accounts are used by scripts or applications that do not support interactive authentication. It is paramount to secure all administrative user accounts with MFA to strengthen access security. For more details on configuring Conditional Access, refer to official Microsoft Documentation: https://learn.microsoft.com/azure/active-directory/conditional-access/overview.
- A. Correct.
Option 1 is correct. By creating a single policy that includes all users and explicitly excluding the service account, you ensure everyone except that service account is required to use MFA. This is a common and recommended approach in Azure AD Conditional Access when certain accounts cannot handle interactive MFA.
- B. Incorrect.
Option 2 is incorrect. The scenario states that administrators (not the service account) must be enforced to use MFA. Enabling MFA only for the service account contradicts the requirement to secure admin accounts.
- C. Incorrect.
Option 3 is incorrect. Limiting the policy to trusted IP ranges and including all accounts (including the service account) would still require MFA for the service account. Additionally, implementing MFA solely based on IP addresses wouldn't exclude the service account from MFA challenges.
- D. Correct.
Option 4 is correct. Instead of a single policy, you can create one policy for administrators with an MFA requirement and a separate policy for the service account that doesn’t enforce MFA. This approach ensures the automation script isn’t broken by MFA prompts while administrators remain protected.