Microsoft 365 Administrator Expert Implementing Conditional Access Policies Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Implementing Conditional Access Policies flashcards as text
A global administrator needs to configure Conditional Access to require reauthentication every 4 hours for users accessing sensitive financial data. Which session control should be used?
Answer: Sign-in frequency set to 4 hours
Sign-in frequency session control forces users to reauthenticate after the specified time interval, regardless of their existing session.
Which Azure AD role is required to create and modify Conditional Access policies?
Answer: Conditional Access Administrator
The Conditional Access Administrator role grants the permissions needed to create, modify, and delete Conditional Access policies.
An organization wants to allow access to Microsoft 365 apps only from devices running Windows 10 or Windows 11. Which Conditional Access condition should be configured?
Answer: Device platform condition targeting 'Windows'
The device platform condition allows targeting of specific operating systems, including Windows, to restrict access accordingly.
A Conditional Access policy has multiple grant controls configured: 'Require MFA' and 'Require compliant device' with 'Require one of the selected controls' logic. What does this mean?
Answer: Users only need to satisfy either MFA or compliant device, not both
'Require one of the selected controls' (OR logic) means satisfying any single grant control is sufficient to gain access.
What happens when a user is subject to two conflicting Conditional Access policies — one that blocks access and one that grants access to the same cloud app?
Answer: The block policy always takes precedence over the grant policy
In Conditional Access, block controls always take precedence over grant controls when multiple policies apply to the same sign-in.
An administrator needs to pilot a new Conditional Access policy for MFA on a small group of users before rolling it out organization-wide. What is the recommended approach?
Answer: Create the policy targeting a pilot security group and enable it in enforced mode
Creating an enforced policy targeted at a specific pilot group allows real-world testing of the policy impact without affecting all users.
A Conditional Access policy requires a compliant device for all users. A guest user from a partner organization tries to access a shared SharePoint site. What is the likely outcome?
Answer: The guest user will be blocked because their device cannot be evaluated for compliance by the host tenant
Guest users' devices are typically not enrolled in the host tenant's Intune, so they cannot meet device compliance requirements and will be blocked.