Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsMedium
A government agency is deploying a highly sensitive application to Azure. They require that all access to the application, regardless of the user's location or device, must use multi-factor authentication (MFA). Additionally, if a user attempts to sign in from an unfamiliar location or a non-compliant device, access should be blocked entirely. Which Azure service should be configured to enforce these rules?
- AAzure Active Directory Identity Protection
- BAzure AD Conditional Access
- CAzure Active Directory Privileged Identity Management (PIM)
- DAzure AD Connect Health
Show answer & explanationAnswer & explanation
Correct answer: B. Azure AD Conditional Access
Azure AD Conditional Access allows you to enforce policies based on conditions such as user, location, device, and application. It can require MFA for all access and block access from non-compliant devices or unfamiliar locations, directly meeting the requirements for granular access control and security enforcement.
Why the other options are wrong
- A. Identity Protection detects and remediates identity-based risks but doesn't directly enforce access policies like requiring MFA based on conditions.
- C. PIM manages just-in-time access for privileged roles, not general user access policies.
- D. Azure AD Connect Health monitors the health of your on-premises identity infrastructure, not for enforcing access policies.
Azure AD Conditional Access
Azure AD Conditional Access is a policy-based engine that evaluates conditions (user, location, device, app) and enforces access controls (block, MFA, compliant device) in real-time.
- Enforces policies based on various conditions.
- Can require MFA, block access, or mandate device compliance.
- Applies to cloud apps and on-premises apps via Application Proxy.
Memory trick: Conditional Access: The security guard checking your ID, location, and uniform.