Microsoft 365 Administrator Expert Implementing Conditional Access Policies Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Implementing Conditional Access Policies flashcards as text
An administrator wants Conditional Access to evaluate every request continuously, not just at initial sign-in. Which feature enables this capability?
Answer: Continuous Access Evaluation (CAE)
Continuous Access Evaluation (CAE) enables near-real-time enforcement of policy changes and revocations without waiting for the token to expire.
A Conditional Access policy targets 'All guest and external users'. Which user type is included by this assignment?
Answer: B2B collaboration guest users invited to the tenant
'All guest and external users' targets B2B collaboration users who have been invited to and have accounts in the Azure AD tenant.
Which named location type can be used to restrict Conditional Access based on specific geographic regions rather than IP addresses?
Answer: Countries/Regions named location
The Countries/Regions named location type uses Azure AD's IP-to-country mapping to restrict or allow access based on geographic location.
An organization uses authentication strength in Conditional Access to require phishing-resistant MFA for privileged administrators. Which method satisfies this requirement?
Answer: FIDO2 security key
FIDO2 security keys meet the phishing-resistant MFA authentication strength requirement because they are bound to the origin and cannot be phished.
A Conditional Access policy uses the 'Require password change' grant control in response to a high user risk. What must the user do to regain access?
Answer: Complete MFA and then change their password through the Azure AD self-service password reset flow
When 'Require password change' is triggered by high user risk, the user must complete MFA and then perform a self-service password reset to remediate the risk.
Which Conditional Access filter condition allows an administrator to target or exclude specific devices based on custom device attributes?
Answer: Filter for devices using device extension attributes
The 'Filter for devices' condition in Conditional Access supports targeting devices based on device properties and extension attributes for granular control.
An administrator is configuring Conditional Access and wants to prevent a policy from accidentally locking out all users during testing. What is the best safeguard?
Answer: Enable the policy in report-only mode and exclude at least one break-glass account from the policy scope
Using report-only mode for initial assessment combined with excluding break-glass accounts ensures that testing does not result in a complete lockout scenario.