An organization is designing a secure access and identity infrastructure using Microsoft Entra ID. The solution must enforce different access controls and verification methods depending on the context of the authentication attempt. Match each business or technical security requirement to the most appropriate Microsoft Entra ID or Conditional Access feature.
- Require multi-factor authentication (MFA) only when a sign-in attempt is classified as a medium or high risk based on real-time telemetry.Conditional Access sign-in risk policy
- Block access to cloud applications when user connections originate from geographic regions outside the organization's approved operating zones.Conditional Access named locations with block controls
- Restrict administrative access to Microsoft Azure portal to require phishing-resistant authentication methods such as FIDO2 security keys.Conditional Access authentication strengths
- Prevent non-compliant corporate devices from accessing business-critical cloud applications.Conditional Access device compliance requirement
Cevap
Sign-in risk policy matches with requiring MFA for medium/high risk; Named locations match with blocking access from unapproved geographic regions; Authentication strengths match with restricting administrative access to phishing-resistant methods; Device compliance requirement matches with blocking non-compliant devices.
The correct mapping pairs each operational requirement to its specialized Conditional Access or Entra ID authentication capability: risk-based policies monitor real-time threat levels, named locations restrict geographic access, authentication strengths dictate the credential type (such as phishing-resistant), and device state checks verify management compliance.
Adım Adım Çözüm
Anahtar Kavram
Designing granular access control policies using Microsoft Entra ID Conditional Access and authentication configurations.