The correct configuration is to set the Condition: Sign-in risk to High and the Grant control to Block access. This works because Azure AD Identity Protection assigns a real-time risk level—Low, Medium, or High—to each sign-in based on suspicious signals like anonymous IP addresses or leaked credentials. The Conditional Access policy then evaluates that risk level through the Sign-in risk condition, and when set to High, the Grant control can enforce Block access, instantly preventing the sign-in from completing. On the AZ-500 exam, this scenario tests your understanding of how Identity Protection feeds risk data into Conditional Access; a common trap is confusing sign-in risk with user risk or selecting a Grant control like Require MFA instead of Block. Remember the direct chain: High risk equals Block access—no remediation, just denial. A simple memory tip is “High risk, no pass—block the glass.”
AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: sign-in risk assesses the risk of a specific authentication attempt.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Azure AD Identity Protection. They want to automatically block sign-ins that are detected as having a high sign-in risk. They have created a Conditional Access policy and assigned it to all users. Which configuration should they add to the policy to trigger the block based on the sign-in risk?
Option A is correct because Azure AD Identity Protection assigns a risk level (Low, Medium, High) to each sign-in based on real-time signals. A Conditional Access policy can use the 'Sign-in risk' condition to evaluate this risk level and, when set to 'High', the 'Grant' control can be configured to 'Block access', which immediately prevents the sign-in from completing. This directly meets the requirement to automatically block high-risk sign-ins.
Key principle: Sign-in risk assesses the risk of a specific authentication attempt.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
This would require MFA instead of blocking, which does not meet the requirement to block access.
✗
Condition: User risk: High, Grant: Require multi-factor authentication.
Why it's wrong here
Incorrect combination: targets user risk rather than sign-in risk, and uses MFA instead of block.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing 'Sign-in risk' with 'User risk', as both are risk types in Identity Protection, but only sign-in risk applies to the current authentication attempt and can be used to block a specific sign-in in real time.
Trap categories for this question
Scenario analysis trap
User risk is based on user behavior over time, not specific sign-in risk. The scenario specifies sign-in risk.
Detailed technical explanation
How to think about this question
Azure AD Identity Protection uses machine learning models to evaluate sign-in risk based on signals such as anonymous IP addresses, atypical travel, and malware-linked IPs. The 'Sign-in risk' condition in Conditional Access evaluates the risk level computed in real-time during the authentication request, and the 'Block access' grant returns an HTTP 403 Forbidden response to the client, preventing token issuance. This is distinct from user risk, which is computed asynchronously and can trigger remediation actions like password reset.
KKey Concepts to Remember
Sign-in risk assesses the risk of a specific authentication attempt.
User risk assesses the overall risk of a user account over time.
Conditional Access policies use 'Grant' controls to enforce access decisions.
Blocking access is a direct action to prevent authentication.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Sign-in risk assesses the risk of a specific authentication attempt.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Review sign-in risk assesses the risk of a specific authentication attempt., then practise related AZ-500 questions on the same topic to reinforce the concept.
Manage identity and access — This question tests Manage identity and access — Sign-in risk assesses the risk of a specific authentication attempt..
What is the correct answer to this question?
The correct answer is: Condition: Sign-in risk: High, Grant: Block access. — Option A is correct because Azure AD Identity Protection assigns a risk level (Low, Medium, High) to each sign-in based on real-time signals. A Conditional Access policy can use the 'Sign-in risk' condition to evaluate this risk level and, when set to 'High', the 'Grant' control can be configured to 'Block access', which immediately prevents the sign-in from completing. This directly meets the requirement to automatically block high-risk sign-ins.
What should I do if I get this AZ-500 question wrong?
Review sign-in risk assesses the risk of a specific authentication attempt., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Sign-in risk assesses the risk of a specific authentication attempt.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.