Microsoft Certified: Identity and Access Administrator AssociateImplement an identity management solutionHard
A company is implementing Azure AD Identity Protection. They want to ensure that all users who are detected with a 'High' sign-in risk are immediately blocked from accessing any resources. Additionally, users with a 'Medium' sign-in risk should be prompted to perform multi-factor authentication (MFA). They have configured two separate Conditional Access policies: one for 'High' sign-in risk (Block access) and another for 'Medium' sign-in risk (Require MFA). A user attempts to sign in, and this particular sign-in is simultaneously detected with both 'High' and 'Medium' sign-in risk. What will be the outcome of this sign-in attempt?
- AThe user will be prompted for MFA.
- BThe user's sign-in will be allowed without any challenge.
- CThe system will report an error and the user will be unable to proceed.
- DThe user's sign-in will be blocked.
Show answer & explanationAnswer & explanation
Correct answer: D. The user's sign-in will be blocked.
When multiple Conditional Access policies apply to a sign-in, all grant controls from all applicable policies must be satisfied. If any applicable policy has a 'Block access' control, that policy takes precedence and the sign-in will be blocked, regardless of other policies that might only require MFA.
Why the other options are wrong
- A. MFA is a 'grant' control. A 'block' control always overrides a 'grant' control in Conditional Access.
- B. Neither policy allows access without a challenge, as risk has been detected.
- C. The system is designed to handle multiple applicable policies, and blocking is a valid outcome, not an error.
Conditional Access Policy Precedence
In Conditional Access, 'Block access' policies take precedence over 'Grant access' policies (like 'Require MFA') when multiple policies apply and conflict.
- All policies are evaluated simultaneously.
- If any policy blocks access, the sign-in is blocked.
- If multiple 'Grant' policies apply, all 'Grant' controls must be satisfied.
Memory trick: Block always wins, it's the 'ultimate veto' in the policy parliament.