An organization is adopting a Zero Trust security model to protect its cloud applications and data. The security team needs a solution that automatically evaluates sign-in context—such as user identity, application, and device status—and enforces Multi-Factor Authentication (MFA) before granting access to resources. Which feature should the organization configure to enforce these access requirements?

Microsoft Entra Conditional Access policies: ### What Microsoft Entra Conditional Access Is **Microsoft Entra Conditional Access** is the policy-based evaluation engine used in Azure to implement **Zero Trust** security. It functions as an "if-then" decision engine that analyzes real-time identity signals to make automated access control decisions. ### How It Meets the Requirements Conditional Access directly enforces the Zero Trust principle of **Verify Explicitly** by evaluating context during sign-in attempts. It allows administrators to: - **Analyze Sign-in Signals**: Evaluate user identity, group membership, target cloud application, device platform, and location. - **Enforce Access Controls**: Require **Multi-Factor Authentication (MFA)**, require managed/compliant devices, or block access entirely based on defined criteria. ### Key Advantages and Capabilities - **Automated Decision-Making**: Dynamically triggers security requirements like MFA only when specific conditions are met. - **Zero Trust Alignment**: Ensures every access request is fully authenticated, authorized, and validated prior to granting access. - **Granular Targeting**: Can be assigned to specific users, administrative roles, or cloud applications (such as Azure Data Explorer or Microsoft 365). - **Centralized Security Governance**: Configured tenant-wide in Microsoft Entra ID to enforce consistent security controls across cloud resources. ### Why This Is Optimal Conditional Access bridges identity verification and resource security, providing the exact mechanism required to evaluate user context and enforce MFA under a Zero Trust framework.