Conditional access policies in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the condition to require MFA for all users.

Azure

policy = {
  "conditions": {
    "users": {
      "include": [[1]]
    }
  }
}

Drag options to blanks, or click blank then click option'

A"ExternalUsers"

B"Guests"

C"Admins"

D"AllUsers"

Attempts:

3 left

💡 Hint

Common Mistakes

Using a specific group like "Admins" instead of all users.

Using "Guests" which only targets guest accounts.

To apply the policy to all users, use "AllUsers" in the include list.

2fill in blank

medium

Complete the code to set the grant control to require multi-factor authentication.

Azure

policy = {
  "grantControls": {
    "operator": "OR",
    "builtInControls": [[1]]
  }
}

Drag options to blanks, or click blank then click option'

A"mfa"

B"passwordChange"

C"trustedLocation"

D"compliantDevice"

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing "compliantDevice" which requires device compliance, not MFA.

Choosing "trustedLocation" which restricts access by location.

The "mfa" control requires users to perform multi-factor authentication.

3fill in blank

hard

Fix the error in the condition to include only users in the 'Sales' group.

Azure

policy = {
  "conditions": {
    "users": {
      "includeGroups": [[1]]
    }
  }
}

Drag options to blanks, or click blank then click option'

A"SalesGroupId"

B"AllUsers"

C"AdminsGroupId"

D"GuestsGroupId"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "AllUsers" which targets everyone, not just Sales.

Using "AdminsGroupId" which targets a different group.

To target the Sales group, use its group ID, here represented as "SalesGroupId".

4fill in blank

hard

Fill both blanks to require MFA only when users sign in from outside trusted locations.

Azure

policy = {
  "conditions": {
    "locations": {
      "include": ["AllLocations"],
      "exclude": [[1]]
    }
  },
  "grantControls": {
    "builtInControls": [[2]]
  }
}

Drag options to blanks, or click blank then click option'

A"TrustedLocations"

B"mfa"

C"compliantDevice"

D"UntrustedLocations"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "UntrustedLocations" in exclude, which is not valid.

Using "compliantDevice" instead of "mfa" for grant control.

Exclude trusted locations and require MFA for all other locations.

5fill in blank

hard

Fill all three blanks to create a policy that applies to all users, requires MFA, and excludes trusted locations.

Azure

policy = {
  "conditions": {
    "users": {
      "include": [[1]]
    },
    "locations": {
      "exclude": [[2]]
    }
  },
  "grantControls": {
    "builtInControls": [[3]]
  }
}

Drag options to blanks, or click blank then click option'

A"AllUsers"

B"TrustedLocations"

C"mfa"

D"Guests"

Attempts:

3 left

💡 Hint

Common Mistakes

Using "Guests" instead of "AllUsers" for users.

Using "TrustedLocations" in include instead of exclude.

Using "compliantDevice" instead of "mfa" for grant control.

This policy targets all users, excludes trusted locations, and requires MFA.

Practice

1. What is the main purpose of a Conditional Access Policy in Azure?

easy

A. To store user passwords securely

B. To create virtual machines automatically

C. To control user access based on specific conditions like location or device

D. To monitor network traffic continuously

Solution

1. Step 1: Understand Conditional Access Policy purpose

   Conditional Access Policies are designed to control access to resources based on conditions such as user location, device state, or risk level.

2. Step 2: Compare options with purpose

   Only To control user access based on specific conditions like location or device describes controlling user access based on conditions, which matches the policy's purpose.

3. Final Answer:

   To control user access based on specific conditions like location or device -> Option C

4. Quick Check:

   Conditional Access controls access by conditions = A [OK]

Hint: Focus on access control based on conditions, not unrelated tasks [OK]

Common Mistakes:

• Confusing Conditional Access with general security monitoring
• Thinking it manages passwords or virtual machines
• Assuming it blocks all users without conditions

2. Which of the following is the correct way to require multi-factor authentication (MFA) in a Conditional Access policy?

easy

A. Disable all sign-in risk detections

B. Enable the policy without any conditions

C. Add a user to the policy without specifying controls

D. Set the grant control to 'Require multi-factor authentication'

Solution

1. Step 1: Identify how MFA is enforced in Conditional Access

   MFA is enforced by setting the grant control to 'Require multi-factor authentication' in the policy settings.

2. Step 2: Evaluate options for correct MFA enforcement

   Only Set the grant control to 'Require multi-factor authentication' correctly sets the grant control to require MFA; others do not enforce MFA properly.

3. Final Answer:

   Set the grant control to 'Require multi-factor authentication' -> Option D

4. Quick Check:

   MFA requires grant control setting = D [OK]

Hint: Look for 'grant control' settings to enforce MFA [OK]

Common Mistakes:

• Enabling policy without specifying MFA control
• Assuming adding users alone enforces MFA
• Disabling risk detection does not require MFA

3. Given a Conditional Access policy that requires MFA only when users sign in from outside the corporate network, what happens if a user signs in from inside the network?

medium

A. The user is granted access without MFA

B. The user is blocked from signing in

C. The user must complete MFA every time

D. The user is forced to reset their password

Solution

1. Step 1: Understand the policy condition

   The policy requires MFA only when users sign in from outside the corporate network, so inside network sign-ins are exempt.

2. Step 2: Determine user experience inside the network

   Since the condition does not apply inside the network, users can sign in without MFA.

3. Final Answer:

   The user is granted access without MFA -> Option A

4. Quick Check:

   MFA required only outside network means inside no MFA = C [OK]

Hint: Check where conditions apply; inside network usually skips MFA [OK]

Common Mistakes:

• Assuming MFA is always required regardless of location
• Thinking users are blocked inside the network
• Confusing MFA with password reset requirements

4. You created a Conditional Access policy to block access from unmanaged devices, but users report they can still sign in from their personal devices. What is the most likely cause?

medium

A. The policy is not assigned to the correct users or groups

B. The policy requires MFA instead of blocking access

C. The users are signing in from managed devices

D. The policy is disabled

Solution

1. Step 1: Check policy assignment

   If users can sign in despite the block, the policy might not be assigned to those users or groups.

2. Step 2: Evaluate other options

   The policy requires MFA instead of blocking access is incorrect because requiring MFA does not block access. The users are signing in from managed devices contradicts the problem statement. The policy is disabled would block all users, not just unmanaged devices.

3. Final Answer:

   The policy is not assigned to the correct users or groups -> Option A

4. Quick Check:

   Policy assignment controls who is affected = A [OK]

Hint: Verify policy targets users/groups to enforce rules [OK]

Common Mistakes:

• Confusing MFA requirement with blocking access
• Assuming devices are managed without verification
• Forgetting to enable the policy

5. You want to create a Conditional Access policy that requires MFA only for users accessing a sensitive app from outside trusted locations, but allows seamless access otherwise. Which combination of conditions and controls should you configure?

hard

A. Assign policy to all users, target all apps, require MFA for all sign-ins regardless of location

B. Assign policy to users, target the sensitive app, set location condition to exclude trusted locations, grant control to require MFA

C. Assign policy to users, target the sensitive app, require password reset for all locations

D. Assign policy to users, target the sensitive app, block access from all locations except trusted ones

Solution

1. Step 1: Define policy scope and conditions

   The policy should apply to specific users and the sensitive app only, with a location condition that excludes trusted locations.

2. Step 2: Set grant control to require MFA

   Grant control should require MFA only when users access from outside trusted locations, allowing seamless access inside.

3. Step 3: Evaluate other options

   Assign policy to all users, target all apps, require MFA for all sign-ins regardless of location forces MFA always, not conditional. Assign policy to users, target the sensitive app, require password reset for all locations incorrectly requires password reset. Assign policy to users, target the sensitive app, block access from all locations except trusted ones blocks access instead of requiring MFA.

4. Final Answer:

   Assign policy to users, target the sensitive app, set location condition to exclude trusted locations, grant control to require MFA -> Option B

5. Quick Check:

   Conditional MFA with location exclusion = B [OK]

Hint: Use location exclusion and grant control 'require MFA' for conditional access [OK]

Common Mistakes:

• Applying MFA to all apps and users unnecessarily
• Using block instead of MFA for outside locations
• Confusing password reset with MFA requirement