Manage identity and access →mediumMultiple ChoiceObjective-mapped

AZ-500 Manage identity and access Practice Question

A company uses Azure Active Directory (Azure AD) and has a conditional access policy that requires multi-factor authentication (MFA) for all external users accessing SharePoint Online. However, the security team wants to enforce that external users must re-authenticate every 30 minutes when accessing SharePoint. Which control should they configure in a new conditional access policy targeting SharePoint Online?

⚠ Common exam trap

It's easy for candidates to confuse 'Sign-in frequency' with 'Grant controls' (like MFA) or 'Conditions' (like risk), not realizing that session controls specifically manage the duration of authentication sessions rather than the method of authentication.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a session control and set 'Sign-in frequency' to 30 minutes.

The 'Sign-in frequency' session control in a Conditional Access policy allows administrators to enforce re-authentication at a specified interval. By setting this to 30 minutes and targeting the SharePoint Online app, external users will be prompted to re-authenticate every 30 minutes, meeting the security team's requirement. This control is independent of MFA and specifically addresses the frequency of authentication sessions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign the policy to 'All cloud apps' and use a grant control to require multi-factor authentication.
Why it's wrong here
In Conditional Access, grant controls enforce conditions at the moment of sign-in — such as requiring MFA, a compliant device, or a terms-of-use acceptance — but they do not govern how long an established session remains valid. Session duration and reauthentication are handled exclusively by session controls, specifically 'Sign-in frequency'. Assigning the policy to all cloud apps would also force MFA everywhere instead of applying a 30-minute reauthentication requirement to the specific app that needs it.
✗
Configure a condition for sign-in risk level and set it to 'High'.
Why it's wrong here
A sign-in risk condition evaluates real-time signals such as impossible travel, atypical locations, or anonymous IP addresses and triggers a policy only when that risk level is detected. Setting the condition to 'High' does not impose any time-based reauthentication; it is event-driven and would leave normal sessions untouched. To enforce a 30-minute session timeout, you need a session control, not a risk condition.
✓
Add a session control and set 'Sign-in frequency' to 30 minutes.
Why this is correct
The 'Sign-in frequency' session control in Azure AD Conditional Access defines how long a user's session remains valid before they must sign in again. Setting it to 30 minutes forces reauthentication every half hour for the targeted cloud app, exactly matching the stated requirement. This is the appropriate control because it is enforced by Azure AD at the session level, independent of the application's own settings.
✗
Configure a session control to use 'App enforced restrictions' for SharePoint.
Why it's wrong here
The 'App enforced restrictions' session control delegates session management to the application itself; for SharePoint, Azure AD relies on the tenant's SharePoint idle session timeout or other app-level settings. This does not guarantee that Azure AD will require reauthentication every 30 minutes, because the enforcement is not performed by Conditional Access. The app's own session timeout may be longer, shorter, or configured differently, so it cannot meet the specific 30-minute sign-in frequency requirement.

Go deeper

AZ-500 Manage identity and access Practice Question

Why each option matters

Option-by-option breakdown

Related to this question