Microsoft 365 FundamentalsDescribe security, compliance, privacy, and trust in Microsoft 365Hard
A Microsoft 365 administrator is implementing a security policy that requires all users accessing sensitive data in SharePoint Online from unmanaged devices to use multi-factor authentication (MFA) and to have their session limited to 'view-only' access. Which Microsoft 365 identity and access management capability should the administrator configure to enforce these specific conditions?
- AAzure AD Privileged Identity Management (PIM)
- BAzure AD Connect Health
- CAzure AD Conditional Access
- DAzure AD Identity Protection
Show answer & explanationAnswer & explanation
Correct answer: C. Azure AD Conditional Access
Azure AD Conditional Access allows administrators to enforce policies based on specific conditions, such as device state (managed/unmanaged), application being accessed, and user risk. It can require MFA and impose session controls like 'Use app enforced restrictions' (which includes view-only access for SharePoint Online), directly addressing the scenario's requirements.
Why the other options are wrong
- A. PIM manages, controls, and monitors access to important resources by providing just-in-time access, not for enforcing access conditions based on device state or session controls.
- B. Azure AD Connect Health monitors the health of your on-premises identity infrastructure, not for enforcing access policies.
- D. Identity Protection focuses on detecting identity-based risks and automating remediation, not on enforcing specific access conditions like MFA or view-only mode based on device state.
Azure AD Conditional Access
A feature of Azure Active Directory that enables organizations to enforce policies based on conditions, such as user, location, device, and application, to control access to resources.
- Evaluates access requests based on multiple signals.
- Can enforce MFA, device compliance, or restrict access.
- Allows granular control over access to cloud apps.
Memory trick: Conditional Access is the security guard at the door, checking your ID and deciding what you can do inside.