AZ-104 Exam - Question 4

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

Your company has an Azure Active Directory (Azure AD) subscription.

You want to implement an Azure AD conditional access policy.

The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.

Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy.

Does the solution meet the goal?

Examice · Accepted Answer

The solution does not meet the goal. While altering the grant control of the Azure AD conditional access policy in the Azure portal can be part of the solution, it is not sufficient on its own. The policy needs to be configured with specific conditions and controls to require Multi-Factor Authentication (MFA) and the use of an Azure AD-joined device when connecting from untrusted locations. Altering the grant control alone does not cover these requirements; conditions must also be set to specify untrusted locations. Therefore, the correct answer is No.

Micah7 · Answer

Answer is A. There is another copy of this question that mentions going to the MFA page in Azure Portal as the solution = incorrect. On that page you cant make a Conditional Access Policy. 
I did this in lab step by step:
- The Answer "A" is correct
- Instead of the MFA page mentioned above, you have to go the route of Conditional Access Policy-->Grant Control mentioned here for this question. Under Grant Control you are given the option of setting MFA and requiring AD joined devices in the exact same window.
Answer is correct.

MCLC2021 · Answer

Correc Answer A (YES). 
Within a Conditional Access policy:
Access Control GRANT:  an administrator can use access controls to grant or block access to resources.
Access Control SESSION:  an administrator can make use of session controls to enable limited experiences within specific cloud applications.

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-session

https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant

Steve1983 · Answer

Thats not all you need to do. Missing the signal and decision  part of the CA policy.

NaoVaz · Answer

In my opinion the correct option is A) "Yes".

To configure MFA the correct way is through Conditional Access Policies.

Madbo · Answer

B. No

Grant control settings in Azure AD conditional access policies determine which users, groups, or applications the policy applies to, but they do not specify the conditions under which the policy applies. To meet the stated goal, the session control settings, which determine the conditions under which the policy applies, should be modified to require MFA and Azure AD-joined devices for Global Administrators connecting from untrusted locations.

james2033 · Answer

Question's keyword "Azure portal to alter the grant control of the Azure AD conditional access policy", choose A. Azure portal can done this task.

Sara_Mo · Answer

answer is no
Conditional Access Policy-->Grant Control 
there is hybrid AD joined devices and not AD joined devices

Shabbow · Answer

B is the correct choice.

EmnCours · Answer

Correct Answer: A

vishalarora1607 · Answer

Yes, this is the way to achieve this.

emptyH · Answer

The Grant contol within the CA Policy is where this option is located

fiahbone · Answer

Grant control is required for this action!

Minaru · Answer

The correct answer is: A

if you are accessing the Azure portal to alter the grant control of the Azure AD conditional access policy, and you are configuring it to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when connecting from untrusted locations, then the solution does indeed meet the goal.

Nico1973 · Answer

B. No
Explanation:
The provided solution does not meet the goal of requiring members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when connecting from untrusted locations. To achieve this, you need to configure the conditions and controls of the Azure AD conditional access policy, not just alter the grant control. By modifying the grant control, you are changing who the policy applies to, not the specific requirements for access.

nherrerab · Answer

A is correct.

Prano · Answer

Ans : A
Access policy>Grant control

timmytimtimo · Answer

thank you for the information

RavindraDevkhile · Answer

A

nqthien041292 · Answer

Vote A

AzureLearner76 · Answer

conditional access is a gate and the filter decides which users go in - after we select the groups and the the untrusted locations we have to decide which is grant access

lh00700 · Answer

Vote A

RalphLiang · Answer

Answer is correct

sorgiulio · Answer

Vote A

epomatti · Answer

The correct option is A

BigBigChannel · Answer

A is correct

[Removed] · Answer

Answer is A

Cool_Z · Answer

A is the right answer here.

belaBen · Answer

is A,  control by conditional access

Cham1 · Answer

ewa sahbis the answer is in the pudding

JustinYoo · Answer

this question is weired

techsdc · Answer

answer A

Rufusinski · Answer

A is correct.

dhivyamohanbabu · Answer

Option A is correct..

ShyamNallu_100813 · Answer

B Is correct

liketopass · Answer

I would say 'partly' as there are 2 requirements :
1. use MFA
2. From untrusted location
And this one only specifies one of them:
To use MFA you indeed use the grant control part, but you would also need to configure the conditions to specify to exclude 'trusted locations' (effectively specifying untrusted locations)
So actually it is maybe a NO as the solution does not meet the goal

_gio_ · Answer

answer is A

kkinna · Answer

because under grand control we can only set requiring  MFA and require AD joined devices but not location.  setting location requirements is located under conditions control panel

Saurabh_Bhargav · Answer

A. Yes

Samiron512 · Answer

correct answer is B. No

Amir1909 · Answer

No is correct

3c5adce · Answer

Yes, the solution meets the goal. By configuring the Azure AD conditional access policy to require members of the Global Administrators group to use Multi-Factor Authentication (MFA) and an Azure AD-joined device when they connect from untrusted locations, you are effectively adding an additional layer of security to protect sensitive resources and data. This ensures that even if credentials are compromised, unauthorized access is prevented by requiring an additional verification step (MFA) and ensuring the device is trusted (Azure AD-joined).

[Removed] · Answer

A is correct

[Removed] · Answer

this is the same as q 2,3,4 the correct answer is B

Makaziwe · Answer

Altering the grant control of Azure AD condition policy allows you to:  require MFA, require the devices to be compliant for Azure AD joint

AZ-104 Exam - Question 4

Discussion