Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsMedium
A financial institution is migrating its applications to Azure. They require a highly secure authentication solution for their critical applications that mandates multi-factor authentication (MFA) and provides conditional access based on user location, device compliance, and sign-in risk. The solution must integrate seamlessly with Azure AD. Which Azure AD feature should be designed to achieve these requirements?
- AAzure AD Identity Protection
- BAzure AD Privileged Identity Management (PIM)
- CAzure AD External Identities
- DAzure AD Conditional Access
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD Conditional Access
Azure AD Conditional Access is the policy-based engine that allows administrators to enforce specific access requirements based on conditions such as user location, device state, and sign-in risk. It is the primary tool for implementing granular access controls and mandating MFA for specific scenarios.
Why the other options are wrong
- A. Identity Protection focuses on detecting and remediating identity-based risks, but Conditional Access is used to enforce policies based on those risks.
- B. PIM manages, controls, and monitors access to important resources by providing just-in-time and just-enough access, not general user authentication conditions.
- C. External Identities manages access for external users (guests, partners) but doesn't provide the conditional access enforcement capabilities for internal users as described.
Azure AD Conditional Access
A feature of Azure Active Directory that enables administrators to enforce automated access control decisions for accessing cloud apps based on various conditions such as user location, device state, application, and sign-in risk.
- Uses 'if-then' statements to enforce policies
- Integrates with MFA, device compliance, and Identity Protection
- Crucial for Zero Trust security models
Memory trick: CONDITIONAL access is the GATEKEEPER.