Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

An organization is designing an identity security strategy using Microsoft Entra ID. You need to match the specific security and access requirements to the correct Microsoft Entra ID Authentication or Conditional Access feature. How should you match the requirements to the appropriate features?

  • Prevent users on unmanaged personal devices from downloading, printing, or syncing files when accessing SharePoint Online.Conditional Access session control using app-enforced restrictions
  • Enforce the use of phishing-resistant authentication methods, such as FIDO2 security keys, when administrators access the Azure portal.Conditional Access grant control using authentication strengths
  • Force users to re-authenticate if their active session is older than 8 hours when they access a critical financial application.Conditional Access session control using sign-in frequency
  • Block access to all cloud applications if a user's sign-in pattern matches real-time anomalous detection patterns indicative of a compromised session.Microsoft Entra ID Protection sign-in risk-based policy

Answer

Preventing downloads on unmanaged devices matches the app-enforced restrictions session control. Enforcing phishing-resistant methods for administrators matches the authentication strengths grant control. Forcing re-authentication after 8 hours matches the sign-in frequency session control. Blocking access for anomalous sign-ins matches the Entra ID Protection sign-in risk-based policy.
Matching the security requirements to their respective Microsoft Entra features relies on understanding the differentiation between session controls, grant controls, and risk-based policy options. App-enforced restrictions are designed for session-level controls in SharePoint/Exchange. Authentication strengths provide granular MFA requirements. Sign-in frequency manages the session lifetime. Sign-in risk policies evaluate live, dynamic threats.

Step-by-Step Solution

1
Analyze the requirement for unmanaged personal devices accessing SharePoint Online.
Identified that restricting down-level actions (download, print, sync) requires the cloud application to receive device status from Entra ID and enforce those restrictions, which is configured via Conditional Access session controls using app-enforced restrictions.
This is a typical use case for SharePoint Online and Exchange Online integrations with Conditional Access.
2
Analyze the requirement to restrict administrative access to phishing-resistant MFA methods.
Identified that Conditional Access grant controls natively support authentication strengths to enforce specific MFA combinations (e.g., phishing-resistant MFA including FIDO2 or Windows Hello for Business).
Standard MFA options allow less secure methods like SMS, so authentication strengths are needed to restrict to phishing-resistant methods.
3
Analyze the requirement for forcing re-authentication after 8 hours.
Identified that the sign-in frequency session control in Conditional Access allows specifying a time interval after which a user must sign in again.
This configuration manages session lifetimes for high-value applications.
4
Analyze the requirement to block anomalous sign-in attempts indicating a compromised session.
Identified that real-time anomalous sign-in detection requires Entra ID Protection (formerly Azure AD Identity Protection) sign-in risk-based policy to evaluate the sign-in risk and apply block or MFA controls.
Conditional Access policies can consume sign-in risk signals from Microsoft Entra ID Protection to dynamically block access.

Key Concept

Microsoft Entra ID offers advanced authentication capabilities and Conditional Access policies, including session controls, authentication strengths, and risk-based integrations, to implement a Zero Trust access security model.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access