Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Entra IDMedium
A company requires that all Global Administrators and other highly privileged roles in Microsoft Entra ID must use multi-factor authentication (MFA) every time they sign in, regardless of their location or device compliance. Additionally, these users should be prompted for MFA even if they are already signed into another Microsoft 365 service within the same session. Which type of policy should be configured to enforce this strict security requirement?
- AMicrosoft Entra Connect sync rules
- BMicrosoft Entra Privileged Identity Management (PIM) access settings
- CMicrosoft Entra ID Protection sign-in risk policy
- DMicrosoft Entra Conditional Access policy
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Entra Conditional Access policy
A Microsoft Entra Conditional Access policy can be configured to target specific privileged roles, require MFA for every sign-in, and use a session control (Sign-in frequency) to ensure re-authentication even within the same session, fulfilling all requirements.
Why the other options are wrong
- A. Microsoft Entra Connect sync rules manage identity synchronization and have no control over authentication policies.
- B. PIM settings control role activation and additional authentication for activation, but not the general sign-in experience for already assigned roles.
- C. ID Protection policies are risk-based and might not always enforce MFA if no risk is detected.
Conditional Access Policies
Microsoft Entra Conditional Access policies are if-then statements that define conditions under which users can access resources. They are used to enforce organizational policies like requiring MFA, blocking access from untrusted locations, or enforcing device compliance.
- If-then statements for access control.
- Combines signals like user, location, device, application.
- Enforces requirements like MFA, compliant devices, approval.
Memory trick: Conditional Access: Conditions Control Entry