Conditional access policies in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does a Conditional Access policy affect user sign-in?

Consider a Conditional Access policy that requires multi-factor authentication (MFA) only when users sign in from outside the corporate network. What happens when a user signs in from inside the corporate network?

A The user is prompted for MFA regardless of location.

B The user signs in without MFA because they are inside the corporate network.

C The user is blocked from signing in.

D The user must reset their password before signing in.

💡 Hint

Think about how location conditions in Conditional Access policies work.

Conditional Access policies can be set to require MFA only when users sign in from outside trusted locations like the corporate network. Inside the network, the policy does not require MFA, so the user signs in normally.

❓ Architecture

intermediate

Which Conditional Access policy setup best protects sensitive cloud apps?

You want to protect a sensitive cloud application so that only users on compliant devices can access it. Which Conditional Access policy configuration achieves this?

A Assign the policy to all users and require device compliance only for the sensitive app.

B Assign the policy to guest users and block access to the sensitive app.

C Assign the policy to all users and require MFA for all apps.

D Assign the policy to all users and block access from all devices.

💡 Hint

Focus on device compliance conditions and app targeting.

To protect a sensitive app, the policy should target that app specifically and require device compliance. This ensures only compliant devices can access it without affecting other apps.

❓ security

advanced

What is the effect of enabling 'Block legacy authentication' in Conditional Access?

Legacy authentication protocols do not support modern security features. What happens when you enable a Conditional Access policy that blocks legacy authentication?

A Users can sign in using any authentication method without restrictions.

B Users must use legacy authentication methods only.

C All users are blocked from signing in regardless of protocol.

D Sign-ins using legacy protocols like POP3 or IMAP are blocked, improving security.

💡 Hint

Consider what legacy authentication means and its security implications.

Blocking legacy authentication prevents sign-ins using older protocols that lack modern security controls, reducing risk of compromise.

❓ Configuration

advanced

Which JSON snippet correctly defines a Conditional Access policy requiring MFA for risky sign-ins?

Given the need to require MFA only when sign-in risk is medium or high, which JSON snippet correctly configures this condition?

A { "conditions": { "signInRiskLevels": ["medium", "high"] }, "grantControls": { "operator": "OR", "builtInControls": ["mfa"] } }

B { "conditions": { "signInRiskLevels": ["low"] }, "grantControls": { "operator": "AND", "builtInControls": ["mfa"] } }

C { "conditions": { "signInRiskLevels": ["none"] }, "grantControls": { "operator": "OR", "builtInControls": ["mfa"] } }

D { "conditions": { "signInRiskLevels": ["high"] }, "grantControls": { "operator": "AND", "builtInControls": ["block"] } }

💡 Hint

Check which risk levels trigger MFA and the correct grant control operator.

The policy must target medium and high sign-in risk levels and require MFA using an OR operator to allow access if any control is satisfied.

✅ Best Practice

expert

What is the recommended approach to test a new Conditional Access policy before full deployment?

You created a Conditional Access policy that blocks access from unmanaged devices. What is the safest way to test this policy without disrupting all users?

A Delete the policy after creation to avoid any risk.

B Enable the policy for all users immediately to see if any issues arise.

C Use the 'Report-only' mode to monitor the policy impact without enforcing it.

D Apply the policy only to guest users and ignore internal users.

💡 Hint

Think about how to observe policy effects safely before enforcement.

'Report-only' mode allows administrators to see what would happen if the policy were enforced, without blocking any users. This helps identify issues before full deployment.