Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Inspect Conditional Access Results in Sign-in Logs
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An IT administrator implements a new Microsoft Entra Conditional Access policy requiring multifactor authentication (MFA). Shortly afterward, several users report that they are unexpectedly blocked when attempting to access company applications.
Which tool in the Microsoft Entra admin center should the administrator use to inspect individual user authentication attempts and review the exact policies that were evaluated?
Explanations
Azure Network Watcher NSG flow logs
Azure Network Watcher NSG flow logs
What Network Watcher NSG flow logs are
Azure Network Watcher NSG flow logs is a feature that captures information about IP traffic flowing through Network Security Groups (NSGs) in an Azure Virtual Network.
Why it doesn't meet the requirement
NSG flow logs operate at the network layer (Layer 4) and record 5-tuple packet data (source IP, destination IP, source port, destination port, and protocol). They have no visibility into identity-level authentication protocols, user credentials, or Microsoft Entra Conditional Access evaluations.
Key characteristics and limitations
- Network layer scope: Analyzes virtual network packet traffic rather than user identity sessions.
- No identity context: Does not capture user accounts, MFA challenges, or tenant policy evaluations.
- Infrastructure focused: Designed to troubleshoot network security group rules and virtual network routing.
This answer would be correct if
The scenario required analyzing permitted or denied network traffic at the subnet or virtual machine network interface level to troubleshoot firewall or security group rules.
Additional context
While Network Watcher is essential for Azure infrastructure networking, identity and access management diagnostics are handled entirely within Microsoft Entra ID.
Microsoft Entra Audit logs under User Management
Microsoft Entra Audit logs under User Management
What Microsoft Entra Audit logs are
Microsoft Entra Audit logs record system changes and administrative actions within the tenant, such as user creation, group membership updates, role assignments, and policy configuration changes.
Why it doesn't meet the requirement
While Audit logs show when a Conditional Access policy was created or edited by an administrator, they do not record sign-in attempts or the evaluation of policies when individual users attempt to access resources.
Key characteristics and limitations
- Change tracking: Records administrative modifications to directory objects, settings, and policies.
- No real-time evaluation data: Does not capture user authentication requests, device compliance states during sign-in, or grant control evaluations.
- Governance purpose: Used primarily to answer who made what administrative change and when.
This answer would be correct if
The administrator needed to review who recently edited or updated the settings of the Conditional Access policy.
Additional context
To understand policy impact on end-users during authentication, administrators must inspect Sign-in logs, while Audit logs are used for auditing administrative actions.
Microsoft Entra Sign-in logs under the Conditional Access tab
Microsoft Entra Sign-in logs under the Conditional Access tab
What Microsoft Entra Sign-in logs are
Microsoft Entra Sign-in logs provide comprehensive records of all authentication attempts within a tenant. Each log record contains rich telemetry regarding the user, application, device state, IP address, and location associated with the sign-in event.
How it meets the troubleshooting requirement
When inspecting a specific sign-in event in the Sign-in logs, administrators can navigate to the Conditional Access tab in the event details pane. This view displays all evaluated Conditional Access policies and reveals whether each policy resulted in Success, Failure, or Not Applied, allowing administrators to pinpoint the exact condition or grant control causing unexpected blocks.
Key advantages and capabilities
- Detailed policy evaluation: Shows whether policy conditions (e.g., location, device platform, client app) were satisfied or unmet.
- Diagnostic tools integration: Provides direct access to the Sign-in diagnostic tool under event troubleshooting to get deeper root-cause insights.
- Error code visibility: Displays specific error codes (such as
53003 BlockedByConditionalAccess) to identify the exact cause of access denial. - Audience reporting: Reveals all downstream resources and service dependencies requested during an authentication attempt.
Why this is optimal
Checking the Sign-in logs is the primary, native method for inspecting real-time and historical authentication events. It gives direct visibility into how identity policies evaluate access requests, making it the most direct and effective troubleshooting tool.
Azure Activity Log
Azure Activity Log
What the Azure Activity Log is
The Azure Activity Log is a platform log that provides insights into subscription-level control plane events across Azure Resource Manager.
Why it doesn't meet the requirement
The Activity Log records management events—such as creating, updating, or deleting Azure resources (e.g., stopping a virtual machine or modifying a resource group). It does not log user authentication events, sign-in attempts, or Conditional Access policy execution details.
Key characteristics and limitations
- Control plane focus: Tracks administrative operations performed on Azure infrastructure resources.
- Subscription boundary: Operates at the Azure subscription level rather than the Microsoft Entra tenant level.
- Lacks sign-in telemetry: Does not collect data about end-user application logins, MFA verification results, or conditional access results.
This answer would be correct if
An administrator needed to determine which administrator created, modified, or deleted an Azure resource or modified subscription configurations.
Additional context
Tenant-level identity audits and user sign-in activities are captured in Microsoft Entra logs, whereas Azure Activity Log is dedicated to Azure Resource Manager management plane operations.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access Report-Only Mode
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra Conditional Access
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Conditional Access Signals
Describe Microsoft Entra Conditional Access
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Zone-Redundant Storage (ZRS)
Describe redundancy options
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Functions Scale to Zero
Describe serverless
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated