Microsoft 365 FundamentalsDescribe core Microsoft 365 services and conceptsHard
A Microsoft 365 administrator is configuring security settings and wants to implement a policy where users are prompted for multi-factor authentication (MFA) only when they attempt to access sensitive company data from an unmanaged device or an unfamiliar location. Which feature within Azure Active Directory (Azure AD) should the administrator configure?
- AAzure AD Identity Protection
- BConditional Access
- CAzure AD Role-Based Access Control (RBAC)
- DAzure AD Privileged Identity Management (PIM)
Show answer & explanationAnswer & explanation
Correct answer: B. Conditional Access
Conditional Access policies in Azure AD allow administrators to enforce specific controls, such as MFA, based on conditions like user location, device state (managed/unmanaged), application being accessed, and sign-in risk. This directly addresses the scenario of prompting MFA under specific conditions.
Why the other options are wrong
- A. Azure AD Identity Protection focuses on detecting and remediating identity-based risks, but Conditional Access is the mechanism to enforce policies based on those risks or other conditions.
- C. Role-Based Access Control (RBAC) assigns permissions based on roles, but it doesn't dynamically apply MFA based on real-time conditions like device state or location.
- D. Privileged Identity Management (PIM) is for managing, controlling, and monitoring access to important resources by providing just-in-time access, not for general conditional MFA for all users.
Azure AD Conditional Access
A feature of Azure Active Directory that enables organizations to enforce controls on how and when users can access resources based on specific conditions.
- Allows 'if-then' statements for access control.
- Conditions can include user location, device state, application, sign-in risk.
- Controls can include requiring MFA, blocking access, or requiring a compliant device.
Memory trick: Conditional Access is the 'Traffic Cop' for your cloud resources.