MS-102 Microsoft 365 Administrator Expert Implementing Conditional Access Policies 2 — Questions and Answers
Question 1: An administrator needs to block legacy authentication protocols for all users in the organization. Which Conditional Access condition should be configured?
- Client apps condition set to 'Exchange ActiveSync clients and other clients' (Correct answer)
- Sign-in risk condition set to 'High'
- Device platform condition set to 'Any device'
- Named locations condition set to 'All trusted locations'
Correct answer: Client apps condition set to 'Exchange ActiveSync clients and other clients'
The 'Exchange ActiveSync clients and other clients' client apps condition targets legacy authentication protocols that do not support modern authentication.
Question 2: A company wants to enforce Conditional Access only for users accessing SharePoint Online from unmanaged devices. Which cloud app should be selected in the policy?
- Office 365
- Microsoft Azure Management
- Office 365 SharePoint Online (Correct answer)
- Microsoft Teams
Correct answer: Office 365 SharePoint Online
Selecting 'Office 365 SharePoint Online' as the cloud app scopes the policy specifically to SharePoint Online access.
Question 3: A Conditional Access policy is set to grant access only when a compliant device is detected, but users report being blocked even on Intune-enrolled devices. What is the most likely cause?
- The device compliance policy has not been assigned to those users (Correct answer)
- The user is not in the correct Azure AD security group
- The sign-in risk level is set to medium
- The named location is configured incorrectly
Correct answer: The device compliance policy has not been assigned to those users
If a device compliance policy is not assigned to users, their devices remain in a 'Not evaluated' state and are not considered compliant.
Question 4: Which Conditional Access session control restricts a user from downloading, printing, or syncing files when accessing a cloud app from an unmanaged device?
- Sign-in frequency
- Persistent browser session
- Application enforced restrictions
- Use Conditional Access App Control (Correct answer)
Correct answer: Use Conditional Access App Control
Conditional Access App Control integrates with Microsoft Defender for Cloud Apps to enforce session-level controls like blocking downloads on unmanaged devices.
Question 5: An administrator wants to ensure that the Conditional Access policy does not lock out break-glass accounts during an authentication incident. What is the recommended approach?
- Assign break-glass accounts to a group excluded from all Conditional Access policies (Correct answer)
- Enable the policy in report-only mode for break-glass accounts
- Configure break-glass accounts with a compliant device requirement
- Set sign-in frequency to 'Every time' for break-glass accounts
Correct answer: Assign break-glass accounts to a group excluded from all Conditional Access policies
Break-glass (emergency access) accounts should be excluded from all Conditional Access policies to ensure administrative access during incidents.
Question 6: A Conditional Access policy uses the 'All users' assignment. Which user type is NOT included by default?
- Guest users
- Service principals (Correct answer)
- Members in the tenant
- Synchronized on-premises users
Correct answer: Service principals
Service principals (workload identities) are not covered by user-based Conditional Access policies and require separate workload identity policies.
Question 7: A company requires MFA only when users sign in from outside the corporate network. What should the administrator configure in the Conditional Access policy?
- Include all locations and exclude the corporate IP range as a named trusted location (Correct answer)
- Include only the corporate IP range and require MFA
- Set the sign-in risk to 'Low' and require MFA
- Configure the device state condition to 'Hybrid Azure AD joined'
Correct answer: Include all locations and exclude the corporate IP range as a named trusted location
By including all locations and excluding the trusted named location (corporate IP range), the policy triggers MFA only for external sign-ins.
MS-102 Microsoft 365 Administrator Expert Implementing Conditional Access Policies 2
An administrator needs to block legacy authentication protocols for all users in the organization.
Which Conditional Access condition should be configured?