Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Requiring Guest MFA with Conditional Access Policies
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is migrating its enterprise applications to Azure and wants to establish strict authentication controls. The security team needs to enforce multi-factor authentication (MFA) specifically for external guest accounts accessing management resources, while allowing administrators to customize signals, target specific apps, and evaluate conditions before granting access.
Which feature should the organization implement to meet these requirements?
Explanations
Security defaults
Security defaults
What Security Defaults Are
Security defaults are preconfigured, Microsoft-managed baseline security settings designed to protect organizations against common identity-related attacks. They provide basic protections such as requiring all users to register for Microsoft Entra multifactor authentication and requiring MFA for administrative roles.
Why It Doesn't Meet the Requirement
Security defaults operate as an all-or-nothing setting across the entire tenant. They do not allow administrators to create customized rules, target specific user groups such as external guests exclusively, or selectively exempt specific applications and resources.
Key Characteristics and Limitations
- Zero Customization: Organizations cannot define custom conditions, granular exclusions, or specific app triggers.
- Incompatible with Conditional Access: If an organization chooses to implement custom Conditional Access policies, security defaults must be completely disabled.
- Fixed Authentication Methods: Enforces standard notification-based authentication through the Microsoft Authenticator app or TOTP software tokens without granular policy options.
This Answer Would Be Correct If
This option would be correct if an organization with a basic or free identity tier needed a quick, preconfigured baseline to enforce MFA across all accounts without needing custom policy definitions.
Additional Context
While security defaults are an excellent starting point for smaller organizations without advanced licensing, enterprise security strategies requiring tailored access rules necessitate moving to Conditional Access.
Per-user multifactor authentication
Per-user multifactor authentication
What Per-User Multifactor Authentication Is
Per-user MFA is an older management method in Microsoft Entra ID where administrators manually enable or enforce multi-factor authentication on an individual user account basis.
Why It Doesn't Meet the Requirement
Per-user MFA applies universally to the user account every time they sign in to any application, regardless of context. It does not provide contextual awareness, meaning it cannot dynamically trigger MFA based on the targeted resource (such as management tools vs. non-sensitive apps) or sign-in risk signals.
Key Characteristics and Limitations
- Static Enforcement: Prompts the user for a secondary authentication factor during every sign-in attempt, leading to user friction.
- Lack of Granular Scoping: Cannot be scoped conditionally based on client application, IP address, device platform, or resource endpoints.
- Higher Administrative Overhead: Requires manual status changes (Enabled or Enforced) per user rather than dynamic policy assignment via group or user type.
This Answer Would Be Correct If
This option would be correct if an administrator needed to manually force specific legacy accounts to undergo an MFA challenge on every single login attempt without utilizing conditional policy engines.
Additional Context
Microsoft recommends that organizations migrate from per-user MFA to Conditional Access policies to achieve better security posture and a seamless user experience.
Service principals
Service principals
What Service Principals Are
A service principal is a local representation of an application object within a specific Microsoft Entra tenant. It defines the access policy, identity, and permissions for automated software, services, or scripts interacting with Azure resources.
Why It Doesn't Meet the Requirement
Service principals are non-interactive machine identities used by programmatic workloads and background applications. They are not an authentication governance policy engine and cannot be used to manage or enforce interactive authentication policies (such as MFA) for human guest users.
Key Characteristics and Limitations
- Workload Identity Role: Functions as the identity mechanism for automated tools, applications, and CI/CD pipelines.
- Non-Interactive Authentication: Uses secrets, certificates, or federated credentials rather than interactive MFA prompts.
- Excluded from Standard User MFA: Standard user-focused MFA policies cannot be fulfilled by automated background service principal connections.
This Answer Would Be Correct If
This option would be correct if the scenario asked how an external automated deployment tool or background daemon should authenticate securely to Azure APIs without human intervention.
Additional Context
While Conditional Access can now protect workload identities, service principals represent the identity being authenticated rather than the overarching policy engine that enforces security requirements.
Conditional Access policies
Conditional Access policies
What Conditional Access Policies Are
Conditional Access is the identity-driven control plane in Microsoft Entra ID (formerly Azure Active Directory) that evaluates real-time signals to enforce organizational access policies. It functions as an "if-then" engine that analyzes context—such as user identity, location, device health, and targeted application—before determining whether to allow, block, or challenge a sign-in attempt.
How It Meets the Requirements
- Targeted MFA Enforcement: Conditional Access allows administrators to scope policies specifically to All guest and external users (B2B identities) without requiring the same disruptions for standard automated or internal service accounts.
- Resource Scoping: The policy can be explicitly targeted to sensitive management tools like the Azure portal or Azure Resource Manager.
- Customizable Access Controls: Administrators can configure grant controls that explicitly require Microsoft Entra multifactor authentication before access is granted.
Key Advantages and Capabilities
- Granular Signal Processing: Evaluates user identity, group membership, network location, device state, and real-time risk detections.
- Flexible Remediation: Delivers targeted challenges such as MFA, device compliance verification, or terms of use acceptance rather than simple allow/deny decisions.
- Report-Only Mode: Enables administrators to test policy impact using audit and sign-in logs before moving enforcement to active production.
- What If Analysis: Includes a simulation tool to predict how specific sign-in scenarios will be evaluated against active policies.
Why This Is Optimal
Compared to basic baseline settings, Conditional Access provides the full customization and granularity necessary to enforce strict, condition-based security requirements across heterogeneous user populations.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Passwordless Authentication
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra ID Single Sign-On
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
FIDO2 Security Keys for Shared Workstations
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe authentication methods in Azure, including single sign-on (SSO), multifactor authentication (MFA), and passwordless
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Shared Responsibility Model Customer Data and Identity
Describe the shared responsibility model
ExpertAZ-500 Microsoft Azure Security Technologies Exam
Application Permissions vs Delegated Permissions
Configure app registration permission scopes
Last updated Validated