Microsoft Certified: Azure Security Engineer AssociateManage identity and accessHard
A manufacturing company uses Azure AD for its workforce identities. They have a specific requirement to enforce multi-factor authentication (MFA) for all users accessing applications tagged as 'High Sensitivity'. Additionally, if a user attempts to sign in from an unfamiliar location, they must be blocked entirely. Which two Azure AD features, when used together, can achieve these specific requirements?
- AAzure AD Conditional Access and Azure AD Identity Protection
- BAzure AD Connect and Azure AD Application Proxy
- CAzure AD B2B collaboration and Azure AD External Identities
- DAzure AD Identity Protection and Azure AD Privileged Identity Management
Show answer & explanationAnswer & explanation
Correct answer: A. Azure AD Conditional Access and Azure AD Identity Protection
Azure AD Conditional Access policies allow you to enforce MFA for specific applications (like 'High Sensitivity' tagged apps) and block access based on location. Azure AD Identity Protection detects 'unfamiliar location' as a risk and feeds this signal into Conditional Access, enabling a policy to block access from such risky sign-ins.
Why the other options are wrong
- B. Azure AD Connect syncs identities, and Application Proxy provides remote access; neither enforces MFA based on app tags nor blocks risky locations.
- C. B2B and External Identities manage guest access; they don't provide the granular access control or risk detection needed here.
- D. PIM manages privileged roles, not general user access based on application tags or risky locations.
Conditional Access with Identity Protection
Combining Conditional Access policies with Identity Protection risk detections to enforce adaptive access controls based on user, sign-in, or user risk levels.
- Conditional Access defines 'what to do' (e.g., block, require MFA).
- Identity Protection defines 'when to do it' by providing risk signals.
- Enables adaptive security, responding to real-time threats.
Memory trick: Conditional Access and Identity Protection: the traffic cop and the risk detector.