mediumMultiple ChoiceObjective-mapped
MS-102 A company uses Microsoft Entra ID P2 licenses Practice Question
A company uses Microsoft Entra ID P2 licenses. The security team wants to require multi-factor authentication (MFA) for all users when accessing any cloud application from networks that are not trusted corporate locations. A group named 'BreakGlass' must be excluded from MFA requirements. Additionally, the company wants to block legacy authentication protocols. Which approach should the administrator use?
⚠ Common exam trap
Watch out — candidates often think a single Conditional Access policy can logically combine a block and a grant control, but Microsoft's policy engine evaluates all conditions and controls together, so a block control overrides any grant control, making it impossible to require MFA while also blocking legacy clients in the same policy without unintended consequences.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create one Conditional Access policy for MFA (targeting all users, excluding BreakGlass, with location condition) and another policy to block legacy authentication (targeting all users, with client apps condition)
It separates the MFA requirement and legacy authentication block into two distinct Conditional Access policies, which is the recommended approach for granular control. The MFA policy targets all users except the BreakGlass group and uses the location condition to require MFA only from untrusted networks. The second policy blocks legacy authentication by targeting all users with the client apps condition set to 'Exchange ActiveSync clients' and 'Other clients', effectively preventing protocols like POP3, IMAP, and SMTP from bypassing modern authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create one Conditional Access policy for MFA (targeting all users, excluding BreakGlass, with location condition) and another policy to block legacy authentication (targeting all users, with client apps condition)
Why this is correct
Creating two separate Conditional Access policies allows independent lifecycle management and precise condition targeting. The MFA policy applies to all users except BreakGlass and includes a location condition (e.g., require MFA from untrusted networks), while the legacy authentication policy strictly targets client apps using basic auth via the client apps condition. This separation ensures that changes to one control do not affect the other, simplifying troubleshooting and regulatory reporting, and aligns with Microsoft's recommended best practice for Conditional Access.
- ✗
Create a single Conditional Access policy that grants access only if MFA is performed and block legacy client apps in the same policy
Why it's wrong here
Combining MFA and legacy authentication blocking into a single Conditional Access policy intertwines distinct security controls, which makes the policy harder to debug and creates unintended dependencies—for example, excluding a user from legacy blocking would also exclude them from MFA. Additionally, a legacy client that cannot perform MFA would be blocked, but the policy would not allow you to independently monitor or conditionally apply MFA vs. legacy block. Microsoft recommends separating these controls because their conditions (location vs. client apps) have different operational triggers and should be handled separately.
- ✗
Enable Security defaults in Entra ID
Why it's wrong here
Security defaults offer a fixed set of preset security policies, such as requiring MFA for all users and blocking legacy authentication, but they provide no ability to exclude specific users like BreakGlass or to configure granular location-based conditions. Because they are tenant-wide and non-customizable, they cannot satisfy the requirement to exempt an emergency access account or to restrict MFA to certain geographic locations. Security defaults are appropriate for basic protection, but not for organizations with P2 licenses and specific security requirements.
- ✗
Use baseline Conditional Access policies
Why it's wrong here
Baseline Conditional Access policies were deprecated by Microsoft and removed from the product, so they cannot be used in current environments. Even when they existed, they offered limited configurability and did not support custom exclusions for BreakGlass accounts or advanced location conditions. Unlike custom Conditional Access policies, baseline policies could not be edited to match the organization's exact requirements, making them unsuitable for a security team needing granular control.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.