Implement and manage Microsoft Entra identity and access →mediumMultiple Choice

MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Exhibit

{
  "ConditionalAccessPolicies": [
    {
      "displayName": "Require MFA for admins",
      "conditions": {
        "users": {
          "includeRoles": ["Global Administrator", "Exchange Administrator"]
        },
        "applications": {
          "includeApplications": ["Office 365 Exchange Online", "Microsoft Azure Management"]
        }
      },
      "grantControls": {
        "builtInControls": ["mfa"]
      }
    }
  ]
}

Refer to the exhibit. You have a Conditional Access policy as shown. The exhibit shows the policy is in Report-only mode and that Microsoft Azure Management is included as the target cloud app. A Global Administrator reports that they are not prompted for MFA when accessing the Azure portal. Which is the most likely reason?

⚠ Common exam trap

The trap is that candidates might assume that as long as a Conditional Access policy includes the correct cloud app (Microsoft Azure Management), it will enforce MFA. However, if the policy is in Report-only mode, it does not enforce any controls, regardless of the app targeting.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is in Report-only mode.

The policy is set to 'Report-only' mode, which means it evaluates sign-ins and logs results but does not enforce any controls like MFA. Even though the policy targets Microsoft Azure Management (which includes the Azure portal), the enforcement mode must be 'On' to require MFA. Since it is in Report-only mode, the Global Administrator is not prompted for MFA.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Global Administrator role is not included in the policy.
Why it's wrong here
Global Administrators are not exempt from Conditional Access, so role exclusion is not the mechanism; the policy simply must include the role as a target. Excluding privileged roles is genuinely useful to prevent admin lockout, which makes it tempting, but the stem gives no evidence of such an exclusion.
✗
The user is accessing from a trusted IP address.
Why it's wrong here
A trusted-location exclusion would skip MFA only if the policy actually contains that condition; the exhibit governs the outcome, and a Global Administrator is not automatically exempt. Trusted IPs are genuinely used to reduce prompts for known office ranges, so this is the intended control in that scenario.
✗
The policy does not include the Azure portal as a target cloud app.
Why it's wrong here
The Azure portal is covered by the Microsoft Azure Management cloud app, so omitting a separate portal entry does not explain the missing MFA prompt. Targeting specific cloud apps is genuinely correct when scoping a policy narrowly, which makes it tempting, but the portal is included via that app.
✓
The policy is in Report-only mode.
Why this is correct
Report-only mode evaluates the policy and logs its outcome without enforcing controls, so sign-ins proceed without an MFA prompt. The Global Administrator's experience confirms the policy is not yet switched to On, which is the enforcement state required to challenge users.

Go deeper

MS-102 Practice Question: Implement and manage Microsoft Entra identity and access

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question