Task 2.2: Plan, implement, and manage Microsoft Entra Conditional Access

• AA policy for all users that blocks device code flow under Authentication flows, excluding Meeting-Rooms

  Correct

  The authentication flows condition targets device code flow, and the location exclusion keeps the rooms working.

• BA Conditional Access policy that blocks the legacy authentication client apps for all users

  Incorrect

  Device code flow is a modern authentication flow, so blocking legacy clients doesn't stop it.

• CA Conditional Access policy that requires a compliant device for all users, all resources and all client apps

  Incorrect

  It doesn't target device code flow and would also stop the conference devices unless they're enrolled.

• DA token protection session control for all users on Windows devices, excluding Meeting-Rooms

  Incorrect

  Token protection binds tokens to devices; it doesn't block device code sign-in.

Conditional Access can target device code flow through the authentication flows condition. Microsoft recommends blocking it wherever possible and allowing it only where needed, for example blocking it everywhere except Android conference room devices in a specific network location.

• AChange the sign-in frequency from 4 hours to Every time

  Incorrect

  Every time forces reauthentication on each request; persistence across restarts is still the persistent browser control's job.

• BTurn off Show option to remain signed in on the company branding sign-in page

  Incorrect

  The Conditional Access persistent browser setting overrides the branding setting, so this isn't what's failing.

• CTarget All resources in the policy with the persistent browser control

  Correct

  The persistent browser control requires All resources, because every browser tab shares one session token.

• DAdd the Require device to be marked as compliant grant control next to the persistent browser setting

  Incorrect

  That would block or allow access; it doesn't change how long the session lasts.

Persistent browser session is controlled by the authentication session token, which all tabs share, so a policy that sets it must target All resources (formerly All cloud apps). Sign-in frequency can stay app specific. The Conditional Access setting overrides the Stay signed in option in company branding.

• AA Conditional Access policy that targets Office 365 SharePoint Online and requires a compliant device

  Incorrect

  A policy on SharePoint Online applies to every site, not only Mergers.

• BA protected action in Microsoft Entra ID that maps SharePoint site access to an authentication context

  Incorrect

  Protected actions cover Microsoft Entra administrative operations, not opening SharePoint sites.

• CAn authentication context published to apps, tagged on the site via its label, targeted by a policy

  Correct

  Authentication context lets a Conditional Access policy protect specific SharePoint content such as one labeled site.

• DA Conditional Access policy that requires a compliant device for the members of the labeled site's group

  Incorrect

  Targeting the members would apply the requirement to everything they open, not only the Mergers site.

An authentication context is created in Conditional Access and selected as Publish to apps. SharePoint sites can be tagged with it, for example through a sensitivity label, and a Conditional Access policy targeting that context enforces the compliant device requirement only when the tagged content is accessed.

• AConditional Access App Control with a session policy that blocks downloads

  Incorrect

  App Control proxies sessions through Defender for Cloud Apps, which Contoso doesn't license.

• BSign-in frequency set to one hour for SharePoint on unmanaged devices

  Incorrect

  Shorter sessions still allow downloads, printing and sync.

• CPersistent browser session set to Never persistent

  Incorrect

  Ending the session at browser close doesn't restrict what users do during it.

• DUse app enforced restrictions, with limited web-only access turned on in SharePoint

  Correct

  SharePoint and Exchange read this signal and give unmanaged devices a browser-only experience.

App enforced restrictions pass device information to SharePoint Online and Exchange Online, which then apply their own limited experience, such as web-only access without download, print or sync, on unmanaged devices. SharePoint's limited access setting is turned on alongside the Conditional Access session control.

• ASign-in logs sent to a Log Analytics workspace through a Microsoft Entra diagnostic setting

  Correct

  The workbook queries sign-in data retained in a Log Analytics workspace.

• BSign-in logs archived to an Azure storage account

  Incorrect

  A storage account archives logs; the workbook doesn't query it.

• CAt least the Security Reader role plus permissions on the Log Analytics workspace

  Correct

  Readers need a Microsoft Entra role and access to the workspace to see the workbook.

• DSign-in logs streamed to an Azure event hub for a SIEM

  Incorrect

  Event hubs feed external tools; the workbook doesn't read them.

• EMicrosoft Entra ID P2 licenses, because report-only results come from ID Protection

  Incorrect

  The workbook needs the P1 licenses that Conditional Access needs; report-only results aren't ID Protection data.

Conditional Access insights and reporting is a workbook over sign-in logs kept in a Log Analytics workspace, so a diagnostic setting must send them there. Viewers need at least Security Reader and the matching Log Analytics workspace permissions.

• AOn, enforcing immediately

  Incorrect

  Template policies aren't enforced by default.

• BReport-only

  Correct

  Each template policy is created in report-only mode so you can test it first.

• COff, with no evaluation

  Incorrect

  Template policies are evaluated by default, but not enforced.

• DPending approval by a second administrator

  Incorrect

  Conditional Access policies have no approval state.

Conditional Access templates create policies in report-only mode by default, so you can monitor their impact before turning them on.

• AWhen the user completes MFA, whatever the device

  Incorrect

  With Require all the selected controls, the compliant device control must be met as well.

• BNever, because the two controls conflict

  Incorrect

  These controls can be combined.

• COnly after an admin approves the sign-in

  Incorrect

  Grant controls don't involve admin approval.

• DOnly when both controls are satisfied

  Correct

  Require all the selected controls needs every selected control.

Grant controls can be combined with Require all the selected controls or with Require one of the selected controls. With Require all the selected controls, the user must complete MFA and sign in from a device marked as compliant.

• ASecurity Reader

  Incorrect

  Readers can't change tenant settings.

• BAuthentication Administrator

  Incorrect

  This role manages users' authentication methods, not tenant security defaults.

• CUser Administrator

  Incorrect

  User Administrator manages users and groups, not security defaults.

• DConditional Access Administrator

  Correct

  Configuring security defaults needs at least this role.

Security defaults provide baseline protections for tenants without Conditional Access. Configuring them, including turning them off before using Conditional Access policies, needs at least the Conditional Access Administrator role.

• A99, identified as c1 to c99

  Correct

  Up to 99 authentication context definitions can be created.

• B10

  Incorrect

  The limit is higher.

• C25

  Incorrect

  The limit is higher.

• DThere's no limit

  Incorrect

  The number is limited to 99.

Authentication contexts are created under Conditional Access > Authentication context. An organization can create up to 99 definitions, c1 to c99, and should keep the set small to limit redirects for users.