A company wants administrators to face a second verification step only when they sign in to the Azure portal from networks outside the head office. Sign-ins from the office should not be challenged. Which Conditional Access setting should be scoped to the office addresses?
Show answer and explanation
Answer: B
Conditional Access location conditions use named locations, which can be defined by IP ranges. Marking the head office ranges as trusted and building a policy that requires MFA when the location is not trusted produces the required behaviour. User risk and sign-in risk are signals from Identity Protection that reflect the likelihood of compromise, not where a sign-in originates. Device platform conditions match operating system types, which says nothing about network location. Risk-based policies would also challenge some sign-ins from anywhere, not just outside the office.
Why the other options are wrong
- A. User risk reflects the likelihood that an account is compromised. It does not tell Conditional Access whether the sign-in comes from the head office.
- C. Device platform conditions match operating systems such as Windows or iOS. They cannot separate office traffic from external traffic.
- D. Sign-in risk flags suspicious sign-in behaviour such as anonymous IP use. Scoping to it would target risky sign-ins, not all sign-ins from outside the office.