Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
How Conditional Access Signals Trigger MFA Policies
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is configuring security policies in Microsoft Entra ID to protect sensitive cloud applications. The security administrator wants to enforce multifactor authentication (MFA) only when users sign in from untrusted public IP locations, use non-compliant mobile devices, or exhibit an elevated sign-in risk level.
Which component of Microsoft Entra Conditional Access represents these input criteria used to make policy decisions?
Explanations
Session controls
Session controls
What Session controls are
Session controls in Microsoft Entra Conditional Access govern the user experience and access parameters within a cloud application after access has already been granted. They enable administrators to control how long a session remains active or to limit user actions inside the target application.
Why it doesn't meet the requirement
Session controls do not serve as the input signals (like location, device state, or risk level) used to evaluate whether access should be granted in the first place. Instead, they manage runtime session characteristics such as sign-in frequency, persistent browser session behavior, and Continuous Access Evaluation (CAE).
Key characteristics and limitations
- Post-authentication management: Controls session lifetime and re-authentication prompts after initial sign-in.
- App-level integration: Integrates with solutions like Microsoft Defender for Cloud Apps to provide in-session monitoring and data loss prevention.
- Not an evaluation signal: Does not identify or measure client-side attributes such as origin IP address or device compliance.
This answer would be correct if
The scenario asked how to enforce continuous in-session monitoring or adjust sign-in frequency and browser persistence settings for users after they access an application.
Additional context
Session controls operate alongside grant controls as potential policy outputs rather than input conditions.
Grant controls
Grant controls
What Grant controls are
In Microsoft Entra Conditional Access, grant controls represent the outcome or enforcement mechanism applied after a policy evaluates the incoming signals. They constitute the "then" portion of the "if-then" policy statement, dictating what requirements a user must satisfy before access is permitted.
Why it doesn't meet the requirement
Grant controls do not represent the input criteria such as the user's IP address, device compliance status, or sign-in risk level. Instead, grant controls are the actions enforced—such as blocking access, requiring multifactor authentication (MFA), or requiring a compliant device—once the policy's input conditions are met.
Key characteristics and limitations
- Enforcement focus: Enforces requirements such as MFA, hybrid Azure AD join, or password reset.
- Terminal or gated: Either blocks the attempt outright or allows access subject to completing defined controls.
- Downstream component: Operates strictly after signals are gathered and evaluated by the Conditional Access engine.
This answer would be correct if
The scenario asked for the Conditional Access component that specifies the required security action (such as enforcing MFA or blocking access) once an untrusted location or risky sign-in is detected.
Additional context
While requiring MFA is a grant control, the contextual data points that trigger this requirement (such as location or risk level) are classified as signals.
Role assignments
Role assignments
What Role assignments are
Role assignments are part of Role-Based Access Control (RBAC) in Microsoft Entra ID and Azure Resource Manager. They grant specific administrative or operational permissions (such as Global Administrator, Contributor, or Reader) to users, groups, or service principals over specific cloud scopes.
Why it doesn't meet the requirement
Role assignments determine what administrative actions a user is authorized to perform within a service or subscription. They do not represent the contextual authentication criteria—such as client IP location, real-time risk score, or mobile device compliance state—evaluated by Conditional Access policies.
Key characteristics and limitations
- Authorization mechanism: Grants permissions to perform specific create, read, update, or delete operations on resources.
- Static privileges: Tied to user or group identities rather than real-time sign-in context.
- Independent framework: Evaluated after identity authentication to enforce access boundaries on management or resource planes.
This answer would be correct if
The scenario asked for the mechanism used to grant an administrator permissions to manage virtual machines or configure identity settings across a subscription.
Additional context
While a user's assigned directory role can be used as one specific signal (identity attribute) within Conditional Access, role assignments themselves do not encompass environmental conditions like network IP ranges or device health.
Signals
Signals
What Signals are in Conditional Access
In Microsoft Entra Conditional Access, signals (also commonly referred to as conditions) are the contextual data points and input attributes that the policy evaluates during an authentication attempt. Conditional Access functions as an intelligent if-then decision engine, where signals form the "if" portion of the policy evaluation before any access decision is enforced.
How Signals meet the scenario requirements
The organization requires access decisions based on several real-time contextual factors:
- IP location: Evaluating whether the user's connection originates from a trusted corporate network range or an untrusted public internet address.
- Device state: Checking whether the device attempting the connection is marked as compliant by Mobile Device Management (MDM) solutions.
- Risk level: Analyzing real-time telemetry and machine learning detections to identify risky sign-in behaviors or compromised credentials.
Key advantages and signal types
Conditional Access processes a wide variety of signals during sign-in:
- User or group identity: Evaluates specific users, group memberships, or directory roles.
- Network location: Matches traffic against configured trusted IP ranges and geographical regions.
- Device platform and compliance: Identifies operating systems and checks whether the device meets compliance standards.
- Application context: Detects the specific cloud application or workload being accessed.
- User and sign-in risk: Leverages identity intelligence to calculate anomalous behaviors and threat patterns in real time.
Why this is optimal
Signals provide the flexible, adaptive inputs necessary for modern Zero Trust security architectures. Rather than applying a static, one-size-fits-all rule, using signals allows organizations to dynamically assess the risk of each connection attempt and apply appropriate safeguards automatically.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Sign-in Logs Conditional Access
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access Report-Only Mode
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Management Groups
Describe management groups
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Hybrid Cloud CapEx vs OpEx
Define cloud models, including public, private, and hybrid
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated