Microsoft 365 Administrator Expert Implementing Conditional Access Policies Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Implementing Conditional Access Policies flashcards as text
When configuring a Conditional Access policy with 'Require hybrid Azure AD join' as a grant control, which devices will satisfy this requirement?
Answer: On-premises domain-joined devices that are also registered in Azure AD
Hybrid Azure AD join applies to devices that are both joined to the on-premises Active Directory domain and registered in Azure AD.
An administrator has configured a Conditional Access policy in 'Report-only' mode. What is the effect of this mode?
Answer: The policy evaluates sign-ins and reports results without enforcing controls
Report-only mode evaluates all sign-ins against the policy conditions and logs what would happen, without actually enforcing the grant or block controls.
A Conditional Access policy requires MFA for all cloud apps, but an administrator needs to exempt the Microsoft Intune Enrollment app. What is the correct configuration?
Answer: Exclude Microsoft Intune Enrollment from the cloud apps assignment
Excluding Microsoft Intune Enrollment from the cloud apps assignment prevents the MFA requirement from applying during the device enrollment process.
Which feature must be enabled in Azure AD before Conditional Access can evaluate user risk conditions?
Answer: Azure AD Identity Protection
Azure AD Identity Protection generates user and sign-in risk signals that Conditional Access policies use to evaluate risk-based conditions.
An administrator configures a Conditional Access policy with 'Require approved client app' as the grant control. Which scenario does this control address?
Answer: Requiring access only from apps that support Intune app protection policies
'Require approved client app' enforces that only Microsoft-approved client applications (which support app protection policies) can access the resource.
A user successfully completes MFA but is still blocked by a Conditional Access policy. What should the administrator check first in the sign-in logs?
Answer: The Conditional Access tab in sign-in logs to review which policy applied and why
The Conditional Access tab in Azure AD sign-in logs shows each policy that was evaluated, its result, and the reason for any block.
A Conditional Access policy is configured to require MFA for the 'All cloud apps' assignment. A new SaaS application is integrated with Azure AD. How will this new app be affected?
Answer: The new app will automatically be subject to the MFA requirement
When 'All cloud apps' is selected, any new application integrated into Azure AD is automatically covered by that Conditional Access policy.