MS-102 Microsoft 365 Administrator Expert Implementing Conditional Access Policies 5 — Questions and Answers
Question 1: An administrator wants Conditional Access to evaluate every request continuously, not just at initial sign-in. Which feature enables this capability?
- Sign-in frequency set to 1 hour
- Continuous Access Evaluation (CAE) (Correct answer)
- Azure AD Identity Protection user risk policy
- Persistent browser session disabled
Correct answer: Continuous Access Evaluation (CAE)
Continuous Access Evaluation (CAE) enables near-real-time enforcement of policy changes and revocations without waiting for the token to expire.
Question 2: A Conditional Access policy targets 'All guest and external users'. Which user type is included by this assignment?
- Users synchronized from on-premises AD
- Members of federated domains in the same tenant
- B2B collaboration guest users invited to the tenant (Correct answer)
- Service accounts in the tenant
Correct answer: B2B collaboration guest users invited to the tenant
'All guest and external users' targets B2B collaboration users who have been invited to and have accounts in the Azure AD tenant.
Question 3: Which named location type can be used to restrict Conditional Access based on specific geographic regions rather than IP addresses?
- IP ranges named location
- Countries/Regions named location (Correct answer)
- Trusted location
- Dynamic location based on GPS
Correct answer: Countries/Regions named location
The Countries/Regions named location type uses Azure AD's IP-to-country mapping to restrict or allow access based on geographic location.
Question 4: An organization uses authentication strength in Conditional Access to require phishing-resistant MFA for privileged administrators. Which method satisfies this requirement?
- SMS one-time passcode
- Microsoft Authenticator push notification
- FIDO2 security key (Correct answer)
- Voice call verification
Correct answer: FIDO2 security key
FIDO2 security keys meet the phishing-resistant MFA authentication strength requirement because they are bound to the origin and cannot be phished.
Question 5: A Conditional Access policy uses the 'Require password change' grant control in response to a high user risk. What must the user do to regain access?
- Complete MFA and then change their password through the Azure AD self-service password reset flow (Correct answer)
- Contact the helpdesk to have their password reset by an administrator
- Sign in from a trusted named location and change their password
- Register a new authentication method and then sign in again
Correct answer: Complete MFA and then change their password through the Azure AD self-service password reset flow
When 'Require password change' is triggered by high user risk, the user must complete MFA and then perform a self-service password reset to remediate the risk.
Question 6: Which Conditional Access filter condition allows an administrator to target or exclude specific devices based on custom device attributes?
- Device platform condition
- Device state condition
- Filter for devices using device extension attributes (Correct answer)
- Named locations condition
Correct answer: Filter for devices using device extension attributes
The 'Filter for devices' condition in Conditional Access supports targeting devices based on device properties and extension attributes for granular control.
Question 7: An administrator is configuring Conditional Access and wants to prevent a policy from accidentally locking out all users during testing. What is the best safeguard?
- Enable the policy in report-only mode and exclude at least one break-glass account from the policy scope (Correct answer)
- Set the policy to target only a single test user account
- Apply the policy only to guest users during initial testing
- Disable all other Conditional Access policies before enabling the new one
Correct answer: Enable the policy in report-only mode and exclude at least one break-glass account from the policy scope
Using report-only mode for initial assessment combined with excluding break-glass accounts ensures that testing does not result in a complete lockout scenario.
MS-102 Microsoft 365 Administrator Expert Implementing Conditional Access Policies 5
An administrator wants Conditional Access to evaluate every request continuously, not just at initial sign-in.
Which feature enables this capability?