mediumMultiple ChoiceObjective-mapped
MS-102 A company uses Azure AD Identity Protection Practice Question
A company uses Azure AD Identity Protection. The security administrator wants to block user sign-ins when the sign-in risk level is detected as 'High' for a custom SaaS application. Which Conditional Access policy configuration should the administrator use?
⚠ Common exam trap
Candidates often confuse Identity Protection risk policies with Conditional Access policies, or mistakenly think that requiring MFA is equivalent to blocking access when the requirement explicitly states 'block user sign-ins.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy set to block access when sign-in risk is high
The requirement is to block sign-ins when the sign-in risk level is 'High' for a custom SaaS application. In Microsoft Entra ID (formerly Azure AD), a Conditional Access policy can be configured with a 'Block access' grant control, which directly denies authentication when the specified condition (sign-in risk level equals High) is met. This is the most straightforward and secure approach to prevent access without relying on additional authentication factors or session controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Conditional Access policy with a grant control to require MFA when sign-in risk is high
Why it's wrong here
A Conditional Access grant control that requires MFA does not prevent the sign-in; it only adds an authentication challenge. If sign-in risk is already high, the user is likely a malicious actor who may have stolen credentials and could also satisfy MFA (e.g., through interception). The requirement is to deny access entirely, so a grant control is insufficient and does not meet the 'block' intent.
- ✓
Create a Conditional Access policy set to block access when sign-in risk is high
Why this is correct
Setting the Conditional Access grant control to 'Block access' with the condition 'Sign-in risk: High' directly denies the authentication attempt before any token is issued. This policy can be scoped to the specific application, providing finer granularity than a global Identity Protection risk policy. Blocking is the only control that guarantees a high-risk sign-in cannot begin a session.
- ✗
Configure a session control in Conditional Access to sign out users when risk is high
Why it's wrong here
Session controls, such as sign-in frequency or app session restrictions, only take effect after the user has successfully authenticated and a session is established. They can restrict or terminate an existing session, but they cannot stop a high-risk sign-in from occurring in the first place. The sign-in risk assessment happens at the moment of authentication, so the control must be applied at that point—not later.
- ✗
Enable Identity Protection risk policy to automatically block users
Why it's wrong here
Identity Protection has user risk policies and sign-in risk policies, but they apply to all applications and not with the granularity of Conditional Access per app. The requirement is for a specific app, so Conditional Access is needed.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.