Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceMedium
A company uses Azure Active Directory (Azure AD) and has several business-critical applications registered in its tenant. They want to implement a security measure that requires users to re-authenticate with multi-factor authentication (MFA) every 30 days when accessing these specific applications, regardless of their location or device, to reduce the risk of credential compromise. What Azure AD feature should be configured to achieve this?
- AAzure AD Access Reviews
- BAzure AD Identity Protection
- CAzure AD Privileged Identity Management (PIM)
- DAzure AD Conditional Access
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD Conditional Access
Azure AD Conditional Access policies allow administrators to enforce specific authentication requirements, such as requiring MFA, based on various conditions. A session control within Conditional Access can be configured to enforce sign-in frequency, requiring users to re-authenticate after a specified time period (e.g., 30 days), which includes MFA if it's part of the authentication policy.
Why the other options are wrong
- A. Azure AD Access Reviews help manage group memberships and access to applications, ensuring users still need access, but they don't enforce re-authentication frequency.
- B. Azure AD Identity Protection detects and remediates identity-based risks, but it doesn't directly enforce specific re-authentication intervals.
- C. Azure AD PIM manages, controls, and monitors access to important resources, primarily for just-in-time access, not for regular re-authentication intervals.
Conditional Access Sign-in Frequency
A session control setting within Azure AD Conditional Access policies that allows administrators to specify how often users are required to re-authenticate, including MFA, for specific applications.
- Enforces re-authentication after a set period.
- Can be applied to specific apps or users.
- Enhances security against long-lived sessions.
Memory trick: Conditional Access is the traffic cop for your digital access.