AZ-900 Practice Question 7: Conditional Access
Microsoft Azure Fundamentals (AZ-900) · Test 1 · question 7 of 10
Security staff at a law firm want multifactor authentication to be prompted only when a user signs in from outside the firm's registered office IP address ranges. Sign-ins from the office should continue with a password alone. Which Azure capability enforces this rule?
Show answer and explanation
Answer:
Conditional Access is Microsoft's identity policy engine, and its policies are if-then statements evaluated after the first authentication factor: *if* these signals are present, *then* require this control. Named locations built from IP address ranges are one of its standard signals, and "require multifactor authentication" is one of its standard grant controls, so the exact rule described is a single policy. (It requires Microsoft Entra ID P1 licensing.)
Option A is wrong because Azure RBAC decides what an already-authenticated identity may do to Azure resources; it has no view of where the sign-in came from and cannot demand extra factors. Option C, Azure Policy, governs the configuration of Azure resources (auditing or denying non-compliant resource deployments), and does not touch user sign-in. Option D, Microsoft Defender for Cloud, assesses and reports on your security posture against standards; it can flag that MFA is missing but it does not enforce the sign-in requirement itself.
Reference: What is Conditional Access?