MS-102 Microsoft 365 Administrator Expert Implementing Conditional Access Policies 4 — Questions and Answers
Question 1: A global administrator needs to configure Conditional Access to require reauthentication every 4 hours for users accessing sensitive financial data. Which session control should be used?
- Persistent browser session set to 'Never persistent'
- Sign-in frequency set to 4 hours (Correct answer)
- Continuous access evaluation policy
- Application enforced restrictions
Correct answer: Sign-in frequency set to 4 hours
Sign-in frequency session control forces users to reauthenticate after the specified time interval, regardless of their existing session.
Question 2: Which Azure AD role is required to create and modify Conditional Access policies?
- Security Reader
- Global Reader
- Conditional Access Administrator (Correct answer)
- Compliance Administrator
Correct answer: Conditional Access Administrator
The Conditional Access Administrator role grants the permissions needed to create, modify, and delete Conditional Access policies.
Question 3: An organization wants to allow access to Microsoft 365 apps only from devices running Windows 10 or Windows 11. Which Conditional Access condition should be configured?
- Client apps condition targeting 'Browser'
- Device platform condition targeting 'Windows' (Correct answer)
- Device state condition targeting 'Hybrid Azure AD joined'
- Named locations targeting the corporate network
Correct answer: Device platform condition targeting 'Windows'
The device platform condition allows targeting of specific operating systems, including Windows, to restrict access accordingly.
Question 4: A Conditional Access policy has multiple grant controls configured: 'Require MFA' and 'Require compliant device' with 'Require one of the selected controls' logic. What does this mean?
- Users must satisfy both MFA and compliant device requirements
- Users only need to satisfy either MFA or compliant device, not both (Correct answer)
- The policy will apply only when both conditions are unmet
- Users must satisfy MFA first, then compliant device
Correct answer: Users only need to satisfy either MFA or compliant device, not both
'Require one of the selected controls' (OR logic) means satisfying any single grant control is sufficient to gain access.
Question 5: What happens when a user is subject to two conflicting Conditional Access policies — one that blocks access and one that grants access to the same cloud app?
- The grant policy always takes precedence over the block policy
- The block policy always takes precedence over the grant policy (Correct answer)
- The policy with the highest priority number takes precedence
- The user is prompted to choose which policy to apply
Correct answer: The block policy always takes precedence over the grant policy
In Conditional Access, block controls always take precedence over grant controls when multiple policies apply to the same sign-in.
Question 6: An administrator needs to pilot a new Conditional Access policy for MFA on a small group of users before rolling it out organization-wide. What is the recommended approach?
- Deploy the policy in report-only mode for all users first, then enable for the pilot group
- Create the policy targeting a pilot security group and enable it in enforced mode (Correct answer)
- Enable the policy organization-wide and monitor the audit logs for issues
- Use Azure AD Identity Protection to restrict the pilot scope
Correct answer: Create the policy targeting a pilot security group and enable it in enforced mode
Creating an enforced policy targeted at a specific pilot group allows real-world testing of the policy impact without affecting all users.
Question 7: A Conditional Access policy requires a compliant device for all users. A guest user from a partner organization tries to access a shared SharePoint site. What is the likely outcome?
- Guest users are always exempt from Conditional Access device compliance requirements
- The guest user will be blocked because their device cannot be evaluated for compliance by the host tenant (Correct answer)
- The guest user will be prompted to enroll their device in the host tenant's Intune
- The guest user will be granted access after completing MFA
Correct answer: The guest user will be blocked because their device cannot be evaluated for compliance by the host tenant
Guest users' devices are typically not enrolled in the host tenant's Intune, so they cannot meet device compliance requirements and will be blocked.
MS-102 Microsoft 365 Administrator Expert Implementing Conditional Access Policies 4
A global administrator needs to configure Conditional Access to require reauthentication every 4 hours for users accessing sensitive financial data.
Which session control should be used?