Microsoft Certified: Identity and Access Administrator AssociateImplement an authentication and access management solutionMedium
A large manufacturing company uses Azure Active Directory (Azure AD) and has several line-of-business (LOB) applications. One critical LOB application, 'Production Control', manages sensitive operational data. The company needs to implement a Conditional Access policy that requires users to use a compliant device AND be within a specific IP range to access the Production Control application. Users accessing from outside this IP range, even with a compliant device, should be blocked. Which two conditions should be configured in the Conditional Access policy to meet these requirements? (Choose two.)
- AClient apps and Device platforms
- BFilter for devices and User risk
- CDevice state and Locations
- DUser risk and Sign-in risk
Show answer & explanationAnswer & explanation
Correct answer: C. Device state and Locations
The requirement specifies 'compliant device' and 'within a specific IP range'. In Conditional Access, 'Device state' is used to check for device compliance, and 'Locations' is used to define and enforce access based on IP ranges.
Why the other options are wrong
- A. Client apps specify the type of application (e.g., browser, mobile app), and Device platforms specify OS (e.g., Windows, iOS), neither directly addresses compliance or IP ranges.
- B. Filter for devices is for more granular device targeting, and User risk is for Identity Protection, not for basic device compliance or IP range enforcement.
- D. User risk and Sign-in risk are related to Identity Protection, not directly to device compliance or IP ranges.
Conditional Access Conditions
Conditional Access policies in Azure AD define 'when' a policy applies by evaluating conditions related to users, devices, locations, applications, and risks.
- Conditions determine the scope of a policy.
- Multiple conditions can be combined using AND logic.
- Common conditions include Users, Cloud apps, Conditions (Sign-in risk, User risk, Device platforms, Locations, Client apps, Device state, Filter for devices).
Memory trick: If THIS happens, THEN do THAT.