MS-102 Practice Question: Require MFA for all users when they access Office…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A: Include all users, exclude none, grant access require MFA with condition 'Location not in trusted locations'.

  Why this is correct

  This policy correctly scopes the requirement: every user is in scope, and the location condition is evaluated during sign-in. When a user's IP address is not within a trusted location (i.e., an IP range you have designated as trusted), the grant control 'Require MFA' is enforced, prompting for multifactor authentication. When the user is in a trusted location, the condition is not satisfied and the policy does not apply, so MFA is not required—matching the business requirement exactly. The location condition acts as a filter, not an assignment, which is the intended design.

• ✗

  B: Include all users, exclude none, block access with condition 'Location not in trusted locations'.

  Why it's wrong here

  With this configuration, any sign-in from a location outside your trusted IP ranges would be denied outright, rather than being challenged to complete MFA. This is an overly restrictive response—it prevents users from accessing Office 365 at all from untrusted locations, which is not the stated requirement; the requirement is to *require MFA*, not to block access. Blocking could also create operational issues for legitimate remote workers, whereas MFA still allows access after satisfying the authentication challenge.

• ✗

  C: Include all users, exclude trusted locations as a group, grant access require MFA.

  Why it's wrong here

  This option misunderstands Conditional Access structure: locations are not a type of group that can be excluded from the 'Include all users' assignment. The user/group assignment scope only accepts Azure AD users, groups, or workload identities; location is a separate condition within the policy. Even if you tried to simulate this by creating a group of users at trusted locations, you cannot dynamically manage it based on their current IP address—trusted locations are defined by named IP ranges, not by user membership. The correct approach is to use the location condition with 'Not in trusted locations' as a filter on the policy.

• ✗

  D: Include all users, exclude all locations, grant access require MFA.

  Why it's wrong here

  The location condition in an Azure AD Conditional Access policy does not support 'exclude all locations' as a meaningful configuration; you can exclude specific trusted locations or choose 'Any location' as the include. If you exclude every possible location, the condition becomes unsatisfiable, but the grant control 'Require MFA' would still be applied unconditionally because the policy has no location restriction to prevent it. This effectively forces MFA for every sign-in, including those from trusted locations, which is more restrictive than the requirement and would frustrate users in the office. The requirement explicitly wants MFA only when the location is not trusted, not always.

Go deeper

Related to this question