Configuring Azure App Service Authentication and Conditional Access for MFA and IP Restrictions
You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)
Quick Answer
The answer is to configure Azure App Service authentication to use Azure AD and create a Conditional Access policy in Microsoft Entra ID that requires MFA and restricts IP ranges. This combination works because App Service authentication delegates user identity verification to Azure AD, while Conditional Access acts as the policy engine that enforces both MFA and IP-based restrictions at the authentication layer, not the network layer. On the Microsoft Cybersecurity Architect exam, this scenario tests your ability to distinguish between identity-centric controls (Conditional Access) and network-centric controls (NSGs, Azure Firewall), a common trap where candidates mistakenly choose network security groups or Azure Firewall for IP restrictions. Remember that App Service runs in a multitenant environment, so IP restrictions must be enforced through Conditional Access policies rather than traditional network security tools. A useful memory tip is "Auth + Policy, not Firewall or NSG" — authentication and conditional access handle user access, while network controls handle infrastructure traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Azure App Service authentication with Microsoft Entra ID
Options B and C are correct. Azure App Service authentication can be configured to use Microsoft Entra ID for user authentication, and a Conditional Access policy can enforce MFA and restrict IP ranges. Option A is incorrect because applying an NSG to the App Service subnet is not the direct method for IP restriction; IP restrictions can be configured directly in the App Service settings. Option D is incorrect because Azure Firewall is a network-level firewall and does not handle user authentication or application-level access control. Option E is incorrect because registering the application is a prerequisite but not a component that directly enforces access rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a network security group (NSG) to the App Service subnet
Why it's wrong here
Network security groups are for virtual networks, not for App Service access control. They do not handle authentication or MFA requirements.
- ✓
Configure Azure App Service authentication with Microsoft Entra ID
Why this is correct
Azure App Service authentication can be configured to use Microsoft Entra ID, which is required for user authentication.
- ✓
Create a Conditional Access policy in Microsoft Entra ID that requires MFA and restricts IP ranges
Why this is correct
Conditional Access policies in Microsoft Entra ID can enforce MFA and restrict IP ranges, meeting the requirements.
- ✗
Deploy Azure Firewall to filter inbound traffic
Why it's wrong here
Azure Firewall is for network traffic filtering, not for user authentication or MFA enforcement.
- ✗
Register the application in Microsoft Entra ID
Why it's wrong here
Registering the application in Microsoft Entra ID is part of the setup but not a direct component for enforcing MFA and IP restrictions.
Visual reference
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization, Adatum, is migrating its on-premises applications to Azure. The applications include a legacy .NET Framework web app that uses Windows authentication and a modern ASP.NET Core API that uses OAuth 2.0. You need to design a secure solution for these applications using Azure App Service. The security requirements include: (1) enforce HTTPS only, (2) restrict access to the web app based on the user's corporate identity, (3) allow the API to access an Azure SQL Database using a managed identity. Which of the following is the correct design?
easy- A.Configure the web app to use Windows authentication via Azure AD Domain Services, and the API to use SQL authentication with a managed identity.
- B.Configure the web app to use Microsoft Entra ID authentication with a built-in policy, and the API to use a connection string with a username and password.
- C.Configure the web app to require client certificates for authentication, and the API to use a connection string with SQL authentication.
- ✓ D.Configure both apps to enforce HTTPS only, configure the web app to use Microsoft Entra ID authentication, and configure the API to use a system-assigned managed identity to access Azure SQL Database.
Why D: It meets all requirements: HTTPS only enforced, Microsoft Entra ID authentication for the web app, and managed identity for the API to access Azure SQL Database. Option A is wrong because Windows authentication via Azure AD Domain Services is not the recommended approach for user authentication in App Service; instead, Microsoft Entra ID authentication should be used. Additionally, the API in option A uses SQL authentication, not managed identity. Option B is wrong because the API should use managed identity, not connection strings. Option C is wrong because SQL authentication is less secure and does not use managed identity.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.