mediumMultiple Select
Enforce MFA from Untrusted Networks Using Conditional Access Named Locations
Administrators want to enforce multi-factor authentication (MFA) for all users when accessing cloud applications from untrusted networks. They plan to use Microsoft Entra Conditional Access with named locations. Which two components must be configured to meet this requirement? (Select two.)
Quick Answer
The answer is a Conditional Access policy targeting all cloud apps and a named location configured with your corporate public IP ranges. This works because named locations in Azure AD define trusted network boundaries; when you mark your corporate IP range as a trusted location, the Conditional Access policy can be set to require MFA for any access that does not originate from that trusted location, effectively enforcing MFA from untrusted networks. On the MS-102 exam, this scenario tests your understanding of how Conditional Access evaluates location conditions—a common trap is forgetting that the policy must target all cloud apps (or the specific apps in scope) and that the named location must be explicitly marked as trusted. A helpful memory tip is “trust the IP, MFA the rest”—the trusted location defines the safe zone, and the policy triggers MFA for everything outside it.
⚠ Common exam trap
Candidates often confuse 'named location' with 'location policy' (Option A) or mistakenly think that targeting MFA registration (Option D) is sufficient to enforce MFA during access, when in fact registration policies only handle the enrollment flow, not the authentication challenge at sign-in.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
named location for the corporate network
Option B is correct because a named location must be defined to represent the trusted corporate network, allowing the Conditional Access policy to distinguish trusted from untrusted networks and apply MFA only when users connect from outside that location. Option C is correct because a Conditional Access policy scoped to all cloud apps is required to enforce the MFA requirement across every cloud application users access. Together, the named location and the Conditional Access policy targeting all cloud apps satisfy the scenario's requirement to enforce MFA from untrusted networks. Option A is not a valid Microsoft Entra ID component; location-based conditions are configured within a Conditional Access policy using named locations, not as a standalone 'location policy.' Option D is incorrect because a policy targeting MFA registration addresses the registration experience for authentication methods, not the enforcement of MFA when accessing cloud applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
location policy
Why it's wrong here
A location policy is a named-locations container defining trusted IP ranges or countries; it holds no grant controls itself, so it cannot enforce MFA. It is tempting because named locations are central to the scenario, but the location policy is the correct component when merely defining which networks Conditional Access should treat as trusted.
- ✓
named location for the corporate network
Why this is correct
A named location defines the corporate network as a trusted IP range, letting the policy distinguish trusted from untrusted access. Without it, Conditional Access cannot evaluate whether a session originates inside or outside the office, so the MFA condition cannot be scoped correctly.
- ✓
Conditional Access policy targeting all cloud apps
Why this is correct
The Conditional Access policy targeting all cloud apps binds the MFA grant control to every application, satisfying the requirement to enforce MFA across cloud apps. Combined with the named location condition, it applies only when access originates from untrusted networks.
- ✗
Conditional Access policy targeting MFA registration
Why it's wrong here
A policy targeting MFA registration governs enrolment in authentication methods, not access enforcement, so it cannot block cloud app sign-ins from untrusted networks. It is tempting because it relates to MFA, but it is the correct choice when requiring users to register methods before accessing resources.
Go deeper
Related to this question
Learn chapter
Entra ID Administration
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Entra ID P1 licenses. They want to allow access to a sensitive cloud application only from the company's trusted office IP ranges (10.0.0.0/24). However, the executive team (group "Execs") must be able to access the app from any location. Which Conditional Access policy configuration should the administrator use?
medium- A.A: Include all users, exclude Execs group, and grant access with condition 'Location not in trusted locations'.
- ✓ B.B: Include all users, exclude Execs group, and block access with condition 'Location not in trusted locations'.
- C.C: Include Execs group, exclude all others, and grant access with condition 'Location in trusted locations'.
- D.D: Include all users, include Execs group as an additional condition, and grant access with condition 'Location in trusted locations'.
Why B: The requirement is to block access from untrusted locations for all users except the Execs group. By including all users, excluding the Execs group, and setting a block control with the condition 'Location not in trusted locations', the policy ensures that only non-Exec users are blocked when accessing from outside the trusted IP range, while Execs remain unrestricted. This aligns with the principle of explicitly blocking unwanted access rather than granting access with conditions that could be bypassed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.