Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Medium
A company is implementing a new policy that requires all employees to use multi-factor authentication (MFA) when accessing Microsoft 365 services from outside the corporate network. Which Microsoft 365 identity protection capability enables this specific requirement?
- ASelf-service password reset (SSPR)
- BAzure AD Connect
- CConditional Access
- DAzure AD Privileged Identity Management (PIM)
Show answer & explanationAnswer & explanation
Correct answer: C. Conditional Access
Conditional Access policies in Azure AD allow administrators to enforce specific controls, such as requiring MFA, based on conditions like user location, device state, and application being accessed. This directly addresses the scenario's requirement.
Why the other options are wrong
- A. SSPR allows users to reset their own passwords, which is unrelated to enforcing MFA based on location.
- B. Azure AD Connect synchronizes identities between on-premises AD and Azure AD, it doesn't enforce access policies.
- D. PIM manages elevated access for administrative roles, not general user access policies.
Conditional Access
A feature of Azure Active Directory that enables organizations to enforce policies for accessing resources based on conditions such as user location, device compliance, and application.
- Enforces powerful access controls.
- Can require MFA, block access, or restrict sessions.
- Evaluates conditions in real-time during sign-in.
Memory trick: Access is Granted Conditionally, like a traffic light for your data.