AZ-500 Manage identity and access Practice Question
A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?
⚠ Common exam trap
Candidates often think a single policy can handle multiple risk levels with different grant controls, but Conditional Access policies enforce a single grant control per policy, so separate policies are required for different risk level actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'
Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'
Why this is correct
A separate policy for medium user risk applied to all users will require MFA when medium risk is detected. The existing policy will continue to block Finance users with high risk. Policy evaluation is not mutually exclusive; the block takes precedence for high risk, and the MFA requirement applies for medium risk.
- ✗
Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'
Why it's wrong here
Modifying the existing policy to cover both high and medium user risk would require MFA for medium risk but would also remove the block for high risk (or require MFA for high risk, which is not the requirement). The policy cannot have different grant controls for different risk levels within the same policy.
- ✗
Use Identity Protection's 'User risk policy' instead of Conditional Access
Why it's wrong here
Identity Protection's user risk policy uses the same risk levels but is applied globally. It cannot be scoped to specific departments (Finance) for the block action while requiring MFA for all users. Conditional Access is needed for the department scope.
- ✗
Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'
Why it's wrong here
This policy would block access for any user with a Medium user risk level, which is far more restrictive than the stated requirement. The requirement is to require MFA, not to deny access; blocking medium-risk users can unnecessarily lock out legitimate users and disrupt productivity. In Azure AD Conditional Access, 'Block access' is an absolute denial that overrides any other grant controls, whereas 'Require multi-factor authentication' allows access after successful verification.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.