Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsHard
A multinational corporation is deploying a sensitive application to Azure. They require that all users accessing the application, regardless of their location, must use a compliant device and multi-factor authentication (MFA). They also need to block access from specific high-risk countries. Which Azure service can enforce these access requirements?
- AAzure AD Connect Health
- BAzure AD Conditional Access
- CAzure AD Identity Protection
- DAzure AD Privileged Identity Management (PIM)
Show answer & explanationAnswer & explanation
Correct answer: B. Azure AD Conditional Access
Azure AD Conditional Access allows administrators to configure policies that evaluate specific conditions (user, location, device state, application) and then enforce access controls, such as requiring MFA, blocking access, or requiring a compliant device. This directly addresses all the stated requirements for granular access control.
Why the other options are wrong
- A. Azure AD Connect Health monitors the health of your on-premises identity infrastructure, not user access policies.
- C. Identity Protection detects identity-based risks and can trigger Conditional Access policies, but it's not the primary service for defining the access policies themselves.
- D. PIM manages privileged role assignments and just-in-time access, not general user access conditions.
Azure AD Conditional Access
Azure AD Conditional Access is the tool used by Azure Active Directory to bring signals together, to make decisions, and enforce organizational policies.
- Evaluates conditions like user group, location, device platform, client application.
- Enforces controls such as MFA, compliant device, password change, or block access.
- Centralizes access management decisions for applications and resources.
Memory trick: Conditional Access: The 'Security Guard' at the gate, checking all conditions before entry.