AZ-305 Practice Question 41: Access Policy Baseline
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 5 · question 1 of 10
A bank's security review of its Microsoft Entra tenant produces four requirements:
- Every user must satisfy multifactor authentication before performing Azure management operations. - Sign-ins that use legacy authentication protocols must be blocked outright. - Holders of privileged directory roles must authenticate with a phishing-resistant method, not merely any second factor. - Two emergency access accounts must remain able to sign in if the policies themselves cause an outage.
What should you recommend?
Show answer and explanation
Answer:
Conditional Access is the policy engine that turns these requirements into enforced if-then statements. Microsoft's own list of commonly applied policies includes requiring multifactor authentication for Azure management tasks, requiring multifactor authentication for users with administrative roles, and blocking sign-ins for users who try to use legacy authentication protocols. Grant controls include *require authentication strength*, which is how a policy demands a phishing-resistant method rather than any second factor, and every policy supports excluding specific accounts, the standard way to protect break-glass accounts from a misconfigured policy.
Option B is the right idea at the wrong granularity. Security defaults apply one fixed baseline to everyone with nothing to target, scope, or exclude, so the bank could neither demand a stronger method for admins only nor exempt its emergency access accounts.
Option C is the pre-Conditional Access approach. Per-user multifactor authentication prompts on every sign-in rather than on the conditions that matter, cannot express "when accessing Azure management", and disabling legacy protocols service by service is an endless manual inventory rather than one tenant-wide block.
Option D covers a different requirement. Risk-based policies react to signals that a particular sign-in looks compromised; they do not require multifactor authentication for normal administrative work, do not block legacy authentication, and carry a Microsoft Entra ID P2 dependency for capability the bank has not asked for.
Reference: Microsoft Entra Conditional Access overview