AZ-400 Develop a security and compliance plan Practice Question
Your organization uses Microsoft Entra ID. You want to ensure that only users from specific countries can access Azure DevOps. Which security feature should you configure?
⚠ Common exam trap
Many exam-takers confuse network-level controls (NSGs) or IP allowlisting in Azure DevOps with identity-based location policies, overlooking that Conditional Access is the correct mechanism for restricting access by country in a SaaS context like Azure DevOps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access policies
Microsoft Entra ID Conditional Access policies allow you to enforce location-based access controls by specifying allowed countries or IP ranges. By configuring a Conditional Access policy that targets Azure DevOps (as a cloud app) and setting the condition to 'Locations' with 'Selected countries,' you can restrict sign-ins to only users from those countries. This is the correct approach because Azure DevOps relies on Entra ID for authentication, and Conditional Access is the native mechanism to control access based on geographic location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Conditional Access policies
Why this is correct
Microsoft Entra ID Conditional Access policies evaluate signals like user location, device state, and risk at sign-in time, allowing you to enforce restrictions such as blocking access from untrusted IP ranges or requiring MFA when users connect from outside the corporate network.
- ✗
Azure Network Security Group (NSG) rules
Why it's wrong here
Azure Network Security Group (NSG) rules filter IP traffic at the subnet or NIC level within a virtual network, controlling which network packets can reach resources; they do not evaluate user identity or location, so they cannot restrict authentication to Azure DevOps based on geographic or IP-based signals.
- ✗
Azure DevOps security groups with allowed IP ranges
Why it's wrong here
Azure DevOps security groups manage permissions for users and groups but do not natively support IP-based restrictions; there is no built-in setting to allow or block sign-in based on a user's IP address or physical location, making them unsuitable for location-based access control.
- ✗
Microsoft Intune compliance policies
Why it's wrong here
Microsoft Intune compliance policies enforce device health and configuration requirements—such as OS version, encryption, or jailbreak status—for managed devices, but they do not consider the user's location or IP address during authentication, so they cannot enforce access policies based on where the user is connecting from.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
DevOps
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the development lifecycle and deliver high-quality software continuously.
Key term
Azure DevOps
Azure DevOps is a Microsoft service that provides development tools for planning, building, testing, and deploying software applications using automated pipelines and collaboration features.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.