Question 2 of 975

Implement and manage identity and access in Microsoft Entra ID →mediumMultiple ChoiceObjective-mapped

Quick Answer

The answer is to create a Conditional Access policy set to block access when sign-in risk is high. This is correct because Azure AD Identity Protection assigns a risk level—low, medium, or high—to each sign-in attempt, and a Conditional Access policy can use that risk as a condition to enforce a “Block access” grant control. When the sign-in risk is high, the policy directly denies authentication, which is the most secure and straightforward way to prevent compromised credentials from accessing a custom SaaS application without requiring additional factors or session controls. On the MS-102 exam, this scenario tests your ability to map Identity Protection risk signals to Conditional Access decisions; a common trap is selecting “Require MFA” instead of “Block access,” which would still allow a high-risk sign-in if MFA is satisfied. Remember the mnemonic “High risk, hard block”—when risk is high, block is the only safe grant control.

MS-102 Practice Question: Implement and manage identity and access in Microsoft Entra ID

This MS-102 practice question tests your understanding of implement and manage identity and access in microsoft entra id. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company uses Azure AD Identity Protection. The security administrator wants to block user sign-ins when the sign-in risk level is detected as 'High' for a custom SaaS application. Which Conditional Access policy configuration should the administrator use?

Question 1mediummultiple choice

Full question →

A
Create a Conditional Access policy with a grant control to require MFA when sign-in risk is high
Why wrong: Requiring MFA is not blocking; high risk sign-ins should be blocked, not just challenged with MFA.
B
Create a Conditional Access policy set to block access when sign-in risk is high
This directly blocks sign-ins with high risk, as required.
C
Configure a session control in Conditional Access to sign out users when risk is high
Why wrong: Session controls apply after sign-in, not to block initial authentication.
D
Enable Identity Protection risk policy to automatically block users
Why wrong: Identity Protection has user risk policies and sign-in risk policies, but they apply to all applications and not with the granularity of Conditional Access per app. The requirement is for a specific app, so Conditional Access is needed.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a Conditional Access policy set to block access when sign-in risk is high

Option B is correct because the requirement is to block sign-ins when the sign-in risk level is 'High' for a custom SaaS application. In Microsoft Entra ID (formerly Azure AD), a Conditional Access policy can be configured with a 'Block access' grant control, which directly denies authentication when the specified condition (sign-in risk level equals High) is met. This is the most straightforward and secure approach to prevent access without relying on additional authentication factors or session controls.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a Conditional Access policy with a grant control to require MFA when sign-in risk is high
Why it's wrong here
Requiring MFA is not blocking; high risk sign-ins should be blocked, not just challenged with MFA.
✓
Create a Conditional Access policy set to block access when sign-in risk is high
Why this is correct
This directly blocks sign-ins with high risk, as required.
Related concept
Read the scenario before looking for a memorised answer.
✗
Configure a session control in Conditional Access to sign out users when risk is high
Why it's wrong here
Session controls apply after sign-in, not to block initial authentication.
✗
Enable Identity Protection risk policy to automatically block users
Why it's wrong here
Identity Protection has user risk policies and sign-in risk policies, but they apply to all applications and not with the granularity of Conditional Access per app. The requirement is for a specific app, so Conditional Access is needed.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse Identity Protection risk policies with Conditional Access policies, or mistakenly think that requiring MFA is equivalent to blocking access when the requirement explicitly states 'block user sign-ins.'

Detailed technical explanation

How to think about this question

Conditional Access policies evaluate conditions like sign-in risk (derived from real-time signals such as anonymous IP addresses, atypical travel, or leaked credentials) before authentication is completed. When the 'Block access' grant is applied, Microsoft Entra ID returns an access denied response to the application, preventing any token issuance. This differs from MFA grant controls, which allow token issuance after additional verification, and from session controls like 'Sign-in frequency' or 'Persistent browser session,' which operate post-authentication via the session cookie.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related MS-102 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Deploy and manage a Microsoft 365 tenant practice questions

Practise MS-102 questions linked to Deploy and manage a Microsoft 365 tenant.

Implement and manage Microsoft Entra identity and access practice questions

Practise MS-102 questions linked to Implement and manage Microsoft Entra identity and access.

Manage security and threats by using Microsoft Defender XDR practice questions

Practise MS-102 questions linked to Manage security and threats by using Microsoft Defender XDR.

Manage compliance by using Microsoft Purview practice questions

Practise MS-102 questions linked to Manage compliance by using Microsoft Purview.

Manage users, groups, licensing, and support practice questions

Practise MS-102 questions linked to Manage users, groups, licensing, and support.

Implement and manage identity and access in Microsoft Entra ID practice questions

Practise MS-102 questions linked to Implement and manage identity and access in Microsoft Entra ID.

MS-102 fundamentals practice questions

Practise MS-102 questions linked to MS-102 fundamentals.

MS-102 scenario practice questions

Practise MS-102 questions linked to MS-102 scenario.

MS-102 troubleshooting practice questions

Practise MS-102 questions linked to MS-102 troubleshooting.

Practice this exam

Start a free MS-102 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

MS-102 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this MS-102 question test?

Implement and manage identity and access in Microsoft Entra ID — This question tests Implement and manage identity and access in Microsoft Entra ID — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create a Conditional Access policy set to block access when sign-in risk is high — Option B is correct because the requirement is to block sign-ins when the sign-in risk level is 'High' for a custom SaaS application. In Microsoft Entra ID (formerly Azure AD), a Conditional Access policy can be configured with a 'Block access' grant control, which directly denies authentication when the specified condition (sign-in risk level equals High) is met. This is the most straightforward and secure approach to prevent access without relying on additional authentication factors or session controls.

What should I do if I get this MS-102 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.