AZ-104 Exam - Question 3

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

Your company has an Azure Active Directory (Azure AD) subscription.

You want to implement an Azure AD conditional access policy.

The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.

Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.

Does the solution meet the goal?

Examice · Accepted Answer

The solution does not meet the goal because altering the session control of the Azure AD conditional access policy is not sufficient to enforce the required conditions for Multi-Factor Authentication and Azure AD-joined devices. To meet the goal, the policy should be configured by altering the grant control, not the session control. The grant control allows administrators to enforce access requirements such as Multi-Factor Authentication and device compliance, which are necessary for ensuring that members of the Global Administrators group use an Azure AD-joined device and MFA when connecting from untrusted locations.

edengoforit · Answer

Sign in to the Azure portal as a global administrator, security administrator, or Conditional Access administrator.
Browse to Azure Active Directory > Security > Conditional Access.
Select New policy.
Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
Under Assignments, select Users and groups
Under Include, select All users
Under Exclude, select Users and groups and choose your organization's emergency access or break-glass accounts.
Select Done.
Under Cloud apps or actions > Include, select All cloud apps.
Under Exclude, select any applications that don't require multi-factor authentication.
Under Access controls > Grant, select Grant access, Require multi-factor authentication, and select Select.
Confirm your settings and set Enable policy to Report-only.
Select Create to create to enable your policy.

Minaru · Answer

Correct answer is B.

The solution mentioned does not fully meet the goal of requiring members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect from untrusted locations. While accessing the Azure portal to alter the session control is a step in the right direction, it's essential to configure the specific conditions and controls in the Azure AD conditional access policy to enforce these requirements.

To achieve the goal, you need to create or modify an Azure AD conditional access policy and specify the conditions that require Multi-Factor Authentication and Azure AD-joined devices for members of the Global Administrators group when they access Azure AD from untrusted locations. Simply accessing the Azure portal to alter session control is not sufficient to fully implement this policy.

powerpro · Answer

B

BenStokes · Answer

Answer should be A

emptyH · Answer

Answer is B.   Require MFA is a checkbox  listed within the GRANT control portion of the conditional access policy.

ShyamNallu_100813 · Answer

ANS :A

MCLC2021 · Answer

Correc Answer B (NO). 
Within a Conditional Access policy:
Access Control GRANT:  an administrator can use access controls to grant or block access to resources.
Access Control SESSION:  an administrator can make use of session controls to enable limited experiences within specific cloud applications.

tsummey · Answer

Under Assignments select the Global Admin Group
Under Conditions set the location to any location and exclude all trusted locations
Under Access Controls, grant access and check the options for require MFA and require the device to be marked as compliant.

Prano · Answer

Ans : B
You can alter the grant control and not the session control

LG2240 · Answer

Security > Conditional Access --> Access controls --> Grant -->

AzureLearner76 · Answer

voting for be , needs a grant

NaoVaz · Answer

In my opinion the correct option is B) "No".

To configure MFA the correct way is through Conditional Access Policies.

Based on the provided documentation the correct approach is through "Grant" Access Controls.

DaJarHead · Answer

From my understanding, session controls is used when wanting to configure policies within a certain cloud apps, ( such as SharePoint, Exchange).

james2033 · Answer

Focus at text "alter the session", it make B is correct choice.

[Removed] · Answer

B is correct

grant control, not session control

nherrerab · Answer

B is correct.

elishlomo · Answer

Correct answer - B. To enforce MFA from an untrusted location, you need to create a conditional access rule that requires MFA with Grant control.

Shabbow · Answer

B is the correct choice.

nqthien041292 · Answer

Vote B

brand9 · Answer

B is the correct grant control

EmnCours · Answer

Correct Answer: B

BigBigChannel · Answer

B is correct

km_2022 · Answer

B is the correct Answer

Rufusinski · Answer

B is correct.

vishalarora1607 · Answer

No this is not the way to achieve this.

SindhuM · Answer

A - is correct

TunaSD · Answer

No, the solution does not meet the goal. Altering the session control of the Azure AD conditional access policy alone will not achieve the desired requirements. You need to configure a conditional access policy that requires Multi-Factor Authentication (MFA) and an Azure AD-joined device for members of the Global Administrators group when connecting from untrusted locations.

Madbo · Answer

Solution B is not correct because it suggests creating a new resource group for each department. While this approach could be used to organize resources, it does not allow for direct association between the virtual machines and their respective departments. Assigning tags to the virtual machines is a better solution for this requirement.

dhivyamohanbabu · Answer

option B is correct

DBFront · Answer

B is correct, needs to be grant control

_gio_ · Answer

answer is B

76d5e04 · Answer

Hello All
I see lot of recommendtions to check "Mlantonis" answers.Please let me know how to find it in this huge blog

3ba6d0b · Answer

questions 3 and 4 are identical.

Makaziwe · Answer

The solutions doesn't meet the goals because altering session control does not directly address the requirements

AZ-104 Exam - Question 3

Discussion