AZ-500 Question 20
Single answerYou are the security administrator at Contoso. You need to ensure that any user signing in from outside your corporate office network is required to use multi-factor authentication (MFA) to access cloud applications. However, you do not want to prompt users for MFA when they sign in from the corporate office's trusted network. Which Conditional Access configuration best meets these requirements with minimal disruption to office-based users?
- A
Create a policy that includes all users and all cloud apps, set Conditions → Locations to include Any location, exclude your named office location, and under Grant select 'Require multi-factor authentication.'
- B
Create a policy that includes only external guest accounts, set Conditions → Device state to include Compliant devices, and under Grant select 'Require multi-factor authentication.'
- C
Create a policy that includes all users but only the Office 365 Exchange Online cloud app, set Conditions → Applications to include only Exchange Online, and under Grant choose 'Block access.'
- D
Create a policy that includes all users, set Conditions → Sign-in Risk to Medium or higher, and under Grant select 'Require password change.'
Show answer and explanation
Correct answer: A
Explanation
In Azure AD Conditional Access, you typically configure a Named Location for the trusted corporate network. Then, for the chosen policy, you include all users, target all apps, include Any location, and exclude the trusted corporate network. This ensures MFA is enforced for sign-ins originating from untrusted locations. For more details, see Microsoft’s documentation on location-based Conditional Access at https://learn.microsoft.com/azure/active-directory/conditional-access/location-condition.
- A. Correct.
Option 1 is correct. First, you include all users so everyone is covered. Next, under the Locations condition, you include Any location but exclude your named office network (configured as a Trusted Location). Finally, under Grant access, you require multi-factor authentication. This ensures that anyone logging in from outside the trusted office network must complete MFA, while office-based users avoid extra prompts.
- B. Incorrect.
Option 2 is incorrect. Restricting only external guest accounts and requiring a compliant device condition would not protect all users signing in from outside the corporate network. The requirement was to enforce MFA for everyone outside the trusted location, not just guests or compliant devices.
- C. Incorrect.
Option 3 is incorrect. Limiting the policy to only Exchange Online would leave other cloud applications unprotected. The scenario states the need for MFA on all cloud applications from outside the office network.
- D. Incorrect.
Option 4 is incorrect. This approach focuses on sign-in risk levels, not on whether the user is signing in from the corporate network or elsewhere. Requiring a password change for Medium or higher risk does not fulfill the location-based MFA requirement.