AZ-500 Manage identity and access Practice Question
A company has a subscription with Azure Active Directory (Azure AD). They want to enable a conditional access policy that requires all users to use multi-factor authentication (MFA) when accessing the Azure portal. The policy should only apply to users who are members of a group called 'AllUsers'. Which assignment should they configure in the policy?
⚠ Common exam trap
Watch out — candidates often confuse the 'Users' assignment with the 'Cloud apps' assignment, mistakenly thinking that groups are assigned to applications rather than to the user scope of the policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the 'AllUsers' group to the 'Users' section and select 'Azure portal' as the cloud app
In an Azure AD Conditional Access policy, the 'Users' section is where you specify which users or groups the policy applies to, and the 'Cloud apps' section is where you select the target application (Azure portal). By assigning the 'AllUsers' group to 'Users' and selecting 'Azure portal' as the cloud app, the policy enforces MFA for all members of that group when they access the Azure portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the 'AllUsers' group to the 'Cloud apps' section and select 'Azure portal' as the application
Why it's wrong here
Assigning the AllUsers group in the Cloud apps section is incorrect because the 'Cloud apps or actions' assignment is exclusively for selecting target applications such as Azure portal, not for specifying user scope. The Users assignment is where groups like AllUsers must be added. Without a valid user scope, the policy cannot evaluate sign-ins for all users correctly, and selecting Azure portal as an application in that section does not create the required binding between user and app.
- ✓
Assign the 'AllUsers' group to the 'Users' section and select 'Azure portal' as the cloud app
Why this is correct
This is the correct configuration because a Conditional Access policy requires both a user scope and an application scope. Adding the AllUsers group in the Users section targets all user identities, and selecting Azure portal as the cloud app limits the policy to sign-ins to that specific application. This combination ensures that every user is evaluated when accessing the Azure portal, allowing you to apply access controls such as MFA.
- ✗
Add a condition for 'Client apps' specifying 'Browser' only
Why it's wrong here
Adding a Client apps condition that specifies Browser only would restrict the policy to sign-ins from web browsers, but it does not establish the required user and application assignments. The core need is to target a user group and the Azure portal cloud app; without those assignments, the policy has no correct scope. Additionally, this condition would inappropriately exclude non-browser clients like PowerShell or the Azure CLI, which may also access Azure portal endpoints.
- ✗
Create two policies: one for users and one for the Azure portal
Why it's wrong here
Creating two separate policies—one for users and one for Azure portal—is unnecessary because a single Conditional Access policy can contain both the Users and Cloud apps assignments. Each policy must include both a user scope and an application scope to be meaningful, so splitting them would leave each policy incomplete and potentially cause conflicting evaluations. Combining them into one policy is the standard, supported approach and avoids issues such as duplicate MFA prompts or inconsistent access grants.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.