Microsoft Certified: Identity and Access Administrator AssociateImplement an authentication and access management solutionHard
A company policy mandates that all users accessing sensitive financial applications must re-authenticate every hour, regardless of their activity. This policy applies even if they are already signed in to other applications. Which Azure AD Conditional Access feature should be used to enforce this continuous re-authentication requirement?
- AConditional Access App Control
- BPersistent browser session control
- CRequire re-authentication grant control
- DSign-in frequency session control
Show answer & explanationAnswer & explanation
Correct answer: D. Sign-in frequency session control
The 'Sign-in frequency' session control in Conditional Access allows administrators to configure how often users are required to re-authenticate, directly meeting the requirement for hourly re-authentication for sensitive applications.
Why the other options are wrong
- A. Conditional Access App Control (MCAS integration) provides real-time monitoring and control over sessions with cloud apps, but not directly a generic re-authentication interval.
- B. Persistent browser session allows users to remain signed in after closing and reopening their browser, which is opposite to the requirement.
- C. There is no 'Require re-authentication grant control' as a standalone option in Conditional Access. Re-authentication is enforced via session controls like sign-in frequency or MFA for specific access attempts.
Conditional Access Session Controls
Conditional Access session controls provide granular control over user sessions after sign-in, allowing administrators to enforce specific requirements like re-authentication frequency or persistent browser sessions.
- Applied after initial access is granted.
- Includes 'Sign-in frequency' (how often to re-authenticate).
- Includes 'Persistent browser session' (allow users to stay signed in).
- Can integrate with Microsoft Defender for Cloud Apps for advanced session controls.
Memory trick: Session Controls: Set the Schedule, Stay in Charge.