mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: A company, Fabrikam, has a hybrid identity…
A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?
⚠ Common exam trap
The trap here is that candidates often focus on policy configuration (e.g., user targeting, session controls) or authentication methods, but the real issue is that legacy protocols completely bypass Conditional Access, making MFA enforcement impossible regardless of policy settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users are using legacy authentication protocols that do not support MFA
The most likely reason is that users are using legacy authentication protocols (e.g., POP3, IMAP, SMTP, or older Office clients) that do not support modern authentication and thus cannot enforce MFA via Conditional Access. Even though the policy requires MFA, legacy protocols bypass the Conditional Access engine entirely, allowing authentication without MFA prompts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AD Connect is not configured for Pass-through Authentication
Why it's wrong here
Pass-through Authentication (PTA) is an authentication method that validates passwords against on-premises Active Directory, but it is not a prerequisite for Azure AD Multi-Factor Authentication. Password hash synchronization, which is commonly deployed, fully supports MFA because the user's primary authentication occurs in Azure AD and then an MFA challenge can be issued. Therefore, the absence of PTA does not explain why MFA is not being enforced for users.
- ✗
The Conditional Access policy does not include session controls
Why it's wrong here
The Conditional Access policy enforces MFA through grant controls, specifically the 'Require multi-factor authentication' grant, not through session controls. Session controls, such as sign-in frequency or app session limitations, only configure behavior after successful authentication and do not determine whether MFA is required. Because the policy already includes the necessary grant control, a missing session control is not the root cause.
- ✗
The Conditional Access policy is not targeting the correct user group
Why it's wrong here
If the Conditional Access policy targets 'All users', then every user, including those observed failing MFA, is within scope, so the target selection is not the problem. A misconfigured group would be problematic if some users were excluded, but targeting all users ensures comprehensive coverage. Thus, the issue is not an incorrect user group assignment.
- ✓
Users are using legacy authentication protocols that do not support MFA
Why this is correct
Legacy authentication protocols such as POP3, IMAP4, and SMTP do not support modern authentication and therefore cannot present additional MFA challenges or respond to Conditional Access grant controls. Azure AD treats these clients as unmanaged and typically exempts them from Conditional Access policies unless explicitly blocked via a separate legacy authentication policy. As a result, users relying on legacy clients can authenticate with only a password, explaining why MFA is being bypassed.
Go deeper
Related to this question
Learn chapter
Zero Trust Principles and Strategy Development
Key term
Microsoft 365 Security Design
Microsoft 365 Security Design is the process of planning and configuring built-in security features in Microsoft 365 to protect data, identities, and devices from cyber threats.
Key term
Zero Trust Strategy
A security model that requires continuous verification of every user, device, and connection before granting access to any resource, regardless of where the request originates.
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.