Develop a security and compliance plan →hardMultiple ChoiceObjective-mapped

Personal Access Tokens and the Conditional Access MFA Gap

Exhibit

{
  "policy": {
    "name": "Require MFA for Azure DevOps",
    "type": "Conditional Access Policy",
    "assignments": {
      "users": "All users",
      "cloud_apps": "Azure DevOps",
      "conditions": {
        "client_apps": ["Browser", "Mobile apps and desktop clients"]
      },
      "grant_controls": {
        "built_in_controls": ["Mfa"]
      }
    }
  }
}

Refer to the exhibit. You have configured a Conditional Access policy in Microsoft Entra ID to require MFA for Azure DevOps. However, users report that they can still access Azure DevOps without MFA when using a PAT for authentication. What is the most likely reason?

Quick Answer

Personal Access Tokens count as legacy authentication in Microsoft Entra ID, and Conditional Access policies — including MFA requirements — simply don't evaluate legacy auth protocols like PATs, OAuth device code flow, or IMAP/POP. So even a correctly configured Conditional Access policy requiring MFA for Azure DevOps has no effect on someone authenticating with a PAT; that path bypasses the policy entirely.

⚠ Common exam trap

Candidates often assume Conditional Access policies apply to all authentication methods equally, not realizing that legacy authentication protocols like PATs, IMAP, and POP are explicitly excluded from policy evaluation unless legacy authentication is blocked at the tenant level.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

PATs are not subject to Conditional Access policies because they use legacy authentication.

B is correct because Personal Access Tokens (PATs) in Azure DevOps are considered legacy authentication tokens. Conditional Access policies in Microsoft Entra ID do not evaluate requests made using legacy authentication protocols, including PATs, OAuth device code flow, or IMAP/POP. Therefore, even if a Conditional Access policy requires MFA for Azure DevOps, users authenticating with a PAT bypass the policy entirely.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy should include 'Require device to be marked as compliant'.
Why it's wrong here
Adding device compliance would not affect PAT authentication.
✓
PATs are not subject to Conditional Access policies because they use legacy authentication.
Why this is correct
PATs are considered legacy authentication and do not satisfy the MFA requirement; they are not evaluated by Conditional Access.
✗
The policy should be scoped to 'All cloud apps' instead of just Azure DevOps.
Why it's wrong here
Scoping to all cloud apps would not change how PATs are treated.
✗
The Conditional Access policy is not enabled.
Why it's wrong here
The exhibit shows a configured policy, but the issue is that PATs bypass Conditional Access.

Visual reference

Go deeper

3 more ways this is tested on AZ-400

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Your company is migrating from on-premises TFS to Azure DevOps Services in the cloud. The security policy mandates that all access to Azure DevOps must go through a conditional access policy that requires multi-factor authentication (MFA) for users outside the corporate network. Additionally, the policy requires that service accounts (used for automated deployments) must use device-based authentication and cannot be interactive. You are configuring Microsoft Entra ID (formerly Azure AD) conditional access. The Azure DevOps organization is connected to the corporate Entra ID tenant. You have the following options: Option A: Create a conditional access policy that applies to all users and service principals, requiring MFA for all cloud apps, and exclude the Azure DevOps app from the policy. Option B: Create a conditional access policy that targets the Azure DevOps app, grant access requiring MFA for all users, and create a separate policy for service accounts that requires device compliance. Option C: Create a conditional access policy that applies to the Azure DevOps app, requiring MFA for all users, and exclude service accounts by user group. Then create a separate policy for service accounts that requires a compliant device. Option D: Use Azure DevOps IP address restrictions to block external traffic and rely on VPN for external users. Which option best meets the requirements?

medium

A.Create a conditional access policy that applies to all users and service principals, requiring MFA for all cloud apps, and exclude the Azure DevOps app
B.Create a conditional access policy that targets the Azure DevOps app, grant access requiring MFA for all users, and create a separate policy for service accounts that requires device compliance
C.Use Azure DevOps IP address restrictions to block external traffic and rely on VPN for external users
✓ D.Create a conditional access policy that applies to the Azure DevOps app, requiring MFA for all users, and exclude service accounts by user group. Then create a separate policy for service accounts that requires a compliant device

Why D: The correct answer is Option D as listed in the answer choices. It creates a conditional access policy targeting the Azure DevOps app, requiring MFA for all users, and excludes service accounts by user group. A separate policy for service accounts requires a compliant device, meeting the device-based, non-interactive authentication requirement while enforcing MFA for external users. Option A excludes Azure DevOps, so no MFA is enforced. Option B applies MFA to service accounts as well, violating the non-interactive requirement. Option C (the IP restriction option) does not use conditional access and does not meet MFA requirements.

Variation 2. Your organization uses Azure DevOps and Microsoft Entra ID. The compliance team needs to ensure that access to Azure DevOps projects is governed by conditional access policies. Which Azure DevOps integration should you use?

easy

✓ A.Link the Azure DevOps organization to the Microsoft Entra ID tenant and configure conditional access policies in Microsoft Entra ID.
B.Configure service hooks to enforce conditional access.
C.Assign managed identities to users for conditional access.
D.Use OAuth tokens to authenticate users.

Why A: To govern access to Azure DevOps projects with conditional access policies, you must link the Azure DevOps organization to the Microsoft Entra ID tenant. This integration makes Azure DevOps a registered application within the tenant, allowing conditional access policies (e.g., MFA, device compliance, location-based access) to be evaluated during authentication. Only then can the compliance team enforce organization-wide access rules via Microsoft Entra ID.

Variation 3. Your organization uses Microsoft Entra ID (formerly Azure AD) for identity management. You need to ensure that only authorized users can access the Azure DevOps organization. What is the most secure way to manage access?

easy

✓ A.Require all users to use multi-factor authentication (MFA) and enable Conditional Access policies.
B.Disable external user access and only allow internal users.
C.Use IP address restrictions to limit access to the corporate network.
D.Add users to the Azure DevOps organization and assign them to the 'Basic' access level.

Why A: Requiring multi-factor authentication (MFA) and enabling Conditional Access policies provides the most secure access control. MFA adds an extra layer of security beyond passwords, and Conditional Access allows granular policy enforcement based on user, device, location, and risk, ensuring only authorized users under secure conditions can access Azure DevOps. Option B is less secure as it does not enforce additional authentication. Option C only restricts access by network location but does not prevent unauthorized access if an attacker is on the corporate network. Option D only grants basic access without security controls.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.

Personal Access Tokens and the Conditional Access MFA Gap

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

3 more ways this is tested on AZ-400