hardMultiple ChoiceObjective-mapped
Conditional Access with Sign-In Risk and Location: Block High Risk, Require Password Change for Medium Risk
A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically block sign-ins for users with high sign-in risk, but only when the sign-in originates from outside the corporate network. For sign-ins from the corporate network, they want to require a password change for medium sign-in risk. A group of emergency access accounts (break-glass) must be excluded from all policies. What should the administrator implement?
Quick Answer
The answer is two separate Conditional Access policies: one for external locations that blocks high sign-in risk, and one for internal locations that requires a password change for medium sign-in risk, both excluding the break-glass group. This is correct because Microsoft Entra ID Conditional Access evaluates location and sign-in risk as independent conditions, and combining different grant controls—block versus require password change—based on location in a single policy is not supported; each policy can only apply one grant control per condition set. On the MS-102 exam, this scenario tests your understanding of how to layer policies for granular security, and a common trap is trying to merge both location and risk levels into one policy, which fails because Conditional Access policies are evaluated as logical ANDs within a single policy. Remember the memory tip: "One policy, one grant—split location and risk to make it fit."
⚠ Common exam trap
Watch out — candidates often assume a single Conditional Access policy can handle multiple condition-to-control mappings, but Microsoft Entra ID requires separate policies for each unique combination of conditions and grant controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Two Conditional Access policies: one for external locations that blocks high risk, and one for internal locations that requires password change for medium risk. Both exclude the break-glass group.
Conditional Access policies evaluate conditions like location and sign-in risk separately, and combining both conditions (external vs. internal) with different grant controls (block vs. require password change) in a single policy is not supported. Two separate policies are required: one for external locations with high risk to block, and one for internal locations with medium risk to require password change. Both must exclude the break-glass group to ensure emergency access is never blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
single Conditional Access policy that blocks access for high risk from external locations and requires password change for medium risk from internal locations, excluding the break-glass group.
Why it's wrong here
A single policy cannot apply different grant controls based on risk level and location simultaneously. Conditional Access policies apply one grant control per policy.
- ✓
Two Conditional Access policies: one for external locations that blocks high risk, and one for internal locations that requires password change for medium risk. Both exclude the break-glass group.
Why this is correct
This meets all requirements: separate policies for different location + risk combinations, and the break-glass group is excluded from both.
- ✗
An Identity Protection user risk policy that blocks high-risk users and prompts for password change for medium-risk users, configured to exclude the break-glass group.
Why it's wrong here
Identity Protection user risk policies cannot target specific network locations; they apply to all sign-ins. The requirements specify location-based differentiation.
- ✗
Conditional Access policy that requires multi-factor authentication for all users except break-glass, and a separate sign-in risk policy for blocking high risk from external locations.
Why it's wrong here
MFA is not requested; the requirement is block for high risk and password change for medium risk. Moreover, a sign-in risk policy does not allow location-based conditions.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Entra ID P2 licenses. The security team wants to automatically require a password change for users with medium sign-in risk, but only when the sign-in originates from outside the corporate network. Users with high sign-in risk should be blocked entirely. A group of break-glass accounts must be excluded from all policies. Which feature should the administrator implement?
medium- ✓ A.Conditional Access policies with sign-in risk and location conditions
- B.Identity Protection risk policies
- C.Privileged Identity Management (PIM)
- D.Azure AD Identity Governance
Why A: Conditional Access policies in Microsoft Entra ID allow combining sign-in risk conditions with location conditions (e.g., 'Not trusted IPs' or 'All trusted locations' set to false) to target only sign-ins from outside the corporate network. The policy can be configured to require a password change for medium risk and block access for high risk, while excluding break-glass accounts via the 'Exclude' tab using a dedicated group.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.