Microsoft 365 Administrator Expert Implementing Conditional Access Policies Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Implementing Conditional Access Policies flashcards as text
An administrator needs to block legacy authentication protocols for all users in the organization. Which Conditional Access condition should be configured?
Answer: Client apps condition set to 'Exchange ActiveSync clients and other clients'
The 'Exchange ActiveSync clients and other clients' client apps condition targets legacy authentication protocols that do not support modern authentication.
A company wants to enforce Conditional Access only for users accessing SharePoint Online from unmanaged devices. Which cloud app should be selected in the policy?
Answer: Office 365 SharePoint Online
Selecting 'Office 365 SharePoint Online' as the cloud app scopes the policy specifically to SharePoint Online access.
A Conditional Access policy is set to grant access only when a compliant device is detected, but users report being blocked even on Intune-enrolled devices. What is the most likely cause?
Answer: The device compliance policy has not been assigned to those users
If a device compliance policy is not assigned to users, their devices remain in a 'Not evaluated' state and are not considered compliant.
Which Conditional Access session control restricts a user from downloading, printing, or syncing files when accessing a cloud app from an unmanaged device?
Answer: Use Conditional Access App Control
Conditional Access App Control integrates with Microsoft Defender for Cloud Apps to enforce session-level controls like blocking downloads on unmanaged devices.
An administrator wants to ensure that the Conditional Access policy does not lock out break-glass accounts during an authentication incident. What is the recommended approach?
Answer: Assign break-glass accounts to a group excluded from all Conditional Access policies
Break-glass (emergency access) accounts should be excluded from all Conditional Access policies to ensure administrative access during incidents.
A Conditional Access policy uses the 'All users' assignment. Which user type is NOT included by default?
Answer: Service principals
Service principals (workload identities) are not covered by user-based Conditional Access policies and require separate workload identity policies.
A company requires MFA only when users sign in from outside the corporate network. What should the administrator configure in the Conditional Access policy?
Answer: Include all locations and exclude the corporate IP range as a named trusted location
By including all locations and excluding the trusted named location (corporate IP range), the policy triggers MFA only for external sign-ins.