How to Interpret Conditional Access Policy JSON for MFA, Terms of Use, and Session Controls
Exhibit
{
"conditions": {
"users": {
"includeUsers": ["All"]
},
"applications": {
"includeApplications": ["All"]
},
"locations": {
"includeLocations": ["AllTrusted"]
},
"clientAppTypes": ["browser", "mobileAppsAndDesktopClients"]
},
"grantControls": {
"builtInControls": ["mfa"],
"termsOfUse": ["termsOfUseId1"]
},
"sessionControls": {
"signInFrequency": {
"value": 1,
"type": "hours"
},
"persistentBrowser": {
"mode": "never"
}
}
}Refer to the exhibit. The conditional access policy JSON shown above is applied to all users. A user authenticates from a trusted location and wants to access a cloud app. Which combination of controls will be enforced?
Quick Answer
The correct combination of controls enforced is MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never. This is because the Conditional Access policy JSON explicitly defines grant controls requiring multi-factor authentication and terms of use acceptance, while the session controls section sets the sign-in frequency to 3600 seconds (1 hour) and the persistent browser limit to “never.” On the MS-102 exam, interpreting JSON for grant and session controls tests your ability to read the raw policy structure rather than relying on the Azure portal interface, and a common trap is confusing the “sessionControls” block with the “grantControls” block—remember that grant controls enforce what must happen before access is allowed, while session controls govern behavior after authentication. A useful memory tip is “Grants get you in, sessions set the rules once you’re in,” so always check both sections of the JSON to avoid missing either MFA or session frequency settings.
⚠ Common exam trap
A common mix-up: candidates assume session controls (like sign-in frequency and persistent browser) are optional or ignored when grant controls are present, but in reality, all controls in both 'grantControls' and 'sessionControls' are enforced together unless explicitly conditional.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never
The conditional access policy JSON explicitly defines three grant controls: 'mfa' (require multi-factor authentication), 'termsOfUse' (require terms of use acceptance), and 'signInFrequency' (value 3600 seconds = 1 hour) combined with 'persistentBrowser' set to 'never'. Since the policy is applied to all users and the user authenticates from a trusted location, all specified controls are enforced simultaneously, as conditional access policies apply all grant controls in the 'grantControls' block unless overridden by session controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
MFA, terms of use acceptance, sign-in frequency of 1 hour, and persistent browser never
Why this is correct
Despite the user authenticating from a trusted location, the conditional access policy's configuration dictates the enforced controls. The policy must explicitly include Multi-Factor Authentication (MFA) and terms of use acceptance within its grant controls, meaning these are required regardless of the trusted location status. Furthermore, the policy's session controls specify a sign-in frequency of 1 hour and persistent browser set to 'never', ensuring re-authentication and session termination after the specified period.
- ✗
Terms of use acceptance and persistent browser never only
Why it's wrong here
MFA is also required.
- ✗
MFA and terms of use acceptance only
Why it's wrong here
Session controls are also enforced.
- ✗
MFA and sign-in frequency of 1 hour only
Why it's wrong here
Terms of use acceptance is also required.
Go deeper
Related to this question
Learn chapter
Conditional Access Policies
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are reviewing a Conditional Access policy in JSON format. The policy is applied to all users accessing Office 365 from trusted locations. What is the intended behavior of this policy?
medium- A.Users are blocked if they are not using a compliant device
- B.Users must provide MFA and use a compliant device
- C.Users only need to provide MFA regardless of device
- ✓ D.Users must provide MFA or use a compliant device
Why D: The policy grants access when users are in a trusted location and either provide MFA or use a compliant device. The 'OR' condition between MFA and device compliance means that satisfying either requirement is sufficient, not both. This is the standard behavior when multiple controls are assigned with 'Require one of the selected controls' in Conditional Access.
Variation 2. You are reviewing a Conditional Access session control configuration in Microsoft Entra ID. Based on the exhibit, what is the expected behavior when a user signs in?
hard- A.The user is blocked from accessing the application unless they have a compliant device.
- B.The user is prompted to reauthenticate every hour.
- ✓ C.The user must reauthenticate every time they access the application, and session monitoring is enabled.
- D.The session is not monitored because cloud app security is null.
Why C: The sign-in frequency is set to 'EveryTime', so the user must reauthenticate every time they access the application. Cloud app security is set to 'Monitor only', enabling session monitoring but not enforcement (e.g., blocking). Option A is incorrect because the configuration does not include a device compliance condition. Option B is incorrect because the frequency is every time, not every hour. Option D is incorrect because cloud app security is explicitly set to 'Monitor only', not null. Therefore, option C is correct.
Variation 3. Refer to the exhibit. You have created a conditional access policy as shown. Users report that they can still access cloud apps from non-compliant devices. What is the most likely reason?
medium- A.The policy does not exclude specific users
- B.The policy does not include all cloud apps
- C.The grant control operator is set to "OR" with only one control, which requires no controls to be satisfied
- ✓ D.The policy uses session controls instead of grant controls
Why D: The policy uses session controls (e.g., 'Use app enforced restrictions') instead of grant controls (e.g., 'Require device to be marked as compliant'). Session controls only apply additional restrictions within the session but do not block access. Therefore, even non-compliant devices can still access cloud apps, though they may experience limited functionality. Grant controls are required to enforce device compliance and block access if the condition is not met.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.