Conditional access policies in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the condition to require MFA for all users.

Azure

policy = {
  "conditions": {
    "users": {
      "include": [[1]]
    }
  }
}

Drag options to blanks, or click blank then click option'

A"ExternalUsers"

B"Guests"

C"Admins"

D"AllUsers"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific group like "Admins" instead of all users.

Using "Guests" which only targets guest accounts.

To apply the policy to all users, use "AllUsers" in the include list.

2fill in blank

medium

Complete the code to set the grant control to require multi-factor authentication.

Azure

policy = {
  "grantControls": {
    "operator": "OR",
    "builtInControls": [[1]]
  }
}

Drag options to blanks, or click blank then click option'

A"mfa"

B"passwordChange"

C"trustedLocation"

D"compliantDevice"

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing "compliantDevice" which requires device compliance, not MFA.

Choosing "trustedLocation" which restricts access by location.

The "mfa" control requires users to perform multi-factor authentication.

3fill in blank

hard

Fix the error in the condition to include only users in the 'Sales' group.

Azure

policy = {
  "conditions": {
    "users": {
      "includeGroups": [[1]]
    }
  }
}

Drag options to blanks, or click blank then click option'

A"SalesGroupId"

B"AllUsers"

C"AdminsGroupId"

D"GuestsGroupId"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "AllUsers" which targets everyone, not just Sales.

Using "AdminsGroupId" which targets a different group.

To target the Sales group, use its group ID, here represented as "SalesGroupId".

4fill in blank

hard

Fill both blanks to require MFA only when users sign in from outside trusted locations.

Azure

policy = {
  "conditions": {
    "locations": {
      "include": ["AllLocations"],
      "exclude": [[1]]
    }
  },
  "grantControls": {
    "builtInControls": [[2]]
  }
}

Drag options to blanks, or click blank then click option'

A"TrustedLocations"

B"mfa"

C"compliantDevice"

D"UntrustedLocations"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "UntrustedLocations" in exclude, which is not valid.

Using "compliantDevice" instead of "mfa" for grant control.

Exclude trusted locations and require MFA for all other locations.

5fill in blank

hard

Fill all three blanks to create a policy that applies to all users, requires MFA, and excludes trusted locations.

Azure

policy = {
  "conditions": {
    "users": {
      "include": [[1]]
    },
    "locations": {
      "exclude": [[2]]
    }
  },
  "grantControls": {
    "builtInControls": [[3]]
  }
}

Drag options to blanks, or click blank then click option'

A"AllUsers"

B"TrustedLocations"

C"mfa"

D"Guests"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "Guests" instead of "AllUsers" for users.

Using "TrustedLocations" in include instead of exclude.

Using "compliantDevice" instead of "mfa" for grant control.

This policy targets all users, excludes trusted locations, and requires MFA.