mediumMultiple SelectObjective-mapped
Enforce MFA from Untrusted Networks Using Conditional Access Named Locations
Administrators want to enforce multi-factor authentication (MFA) for all users when accessing cloud applications from untrusted networks. They plan to use Azure AD Conditional Access with named locations. Which two components must be configured to meet this requirement? (Select two.)
Quick Answer
The answer is a Conditional Access policy targeting all cloud apps and a named location configured with your corporate public IP ranges. This works because named locations in Azure AD define trusted network boundaries; when you mark your corporate IP range as a trusted location, the Conditional Access policy can be set to require MFA for any access that does not originate from that trusted location, effectively enforcing MFA from untrusted networks. On the MS-102 exam, this scenario tests your understanding of how Conditional Access evaluates location conditions—a common trap is forgetting that the policy must target all cloud apps (or the specific apps in scope) and that the named location must be explicitly marked as trusted. A helpful memory tip is “trust the IP, MFA the rest”—the trusted location defines the safe zone, and the policy triggers MFA for everything outside it.
⚠ Common exam trap
Candidates often confuse 'named location' with 'location policy' (Option A) or mistakenly think that targeting MFA registration (Option D) is sufficient to enforce MFA during access, when in fact registration policies only handle the enrollment flow, not the authentication challenge at sign-in.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
named location for the corporate network
Named locations in Azure AD Conditional Access allow administrators to define trusted network boundaries, such as the corporate network's public IP range. By marking this named location as a trusted location, the Conditional Access policy can then require MFA when users access cloud applications from any network that is not the corporate network, effectively enforcing MFA from untrusted networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
location policy
Why it's wrong here
There is no separate 'location policy' in Azure AD; locations are defined as named locations.
- ✓
named location for the corporate network
Why this is correct
Named locations define trusted IP ranges that the Conditional Access policy can use to distinguish trusted from untrusted networks.
- ✓
Conditional Access policy targeting all cloud apps
Why this is correct
The policy must include all cloud apps and use the condition 'Not from named location' to require MFA.
- ✗
Conditional Access policy targeting MFA registration
Why it's wrong here
This policy is used to require users to register MFA methods, not to enforce MFA during sign-in.
Go deeper
Related to this question
Learn chapter
Conditional Access Policies
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Entra ID P1 licenses. They want to allow access to a sensitive cloud application only from the company's trusted office IP ranges (10.0.0.0/24). However, the executive team (group "Execs") must be able to access the app from any location. Which Conditional Access policy configuration should the administrator use?
medium- A.A: Include all users, exclude Execs group, and grant access with condition 'Location not in trusted locations'.
- ✓ B.B: Include all users, exclude Execs group, and block access with condition 'Location not in trusted locations'.
- C.C: Include Execs group, exclude all others, and grant access with condition 'Location in trusted locations'.
- D.D: Include all users, include Execs group as an additional condition, and grant access with condition 'Location in trusted locations'.
Why B: The requirement is to block access from untrusted locations for all users except the Execs group. By including all users, excluding the Execs group, and setting a block control with the condition 'Location not in trusted locations', the policy ensures that only non-Exec users are blocked when accessing from outside the trusted IP range, while Execs remain unrestricted. This aligns with the principle of explicitly blocking unwanted access rather than granting access with conditions that could be bypassed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.