Design security operations, identity, and compliance capabilities →hardMultiple ChoiceObjective-mapped
Why Is My Conditional Access Policy Not Blocking High Risk Users?
Exhibit
{
"properties": {
"displayName": "Block high-risk sign-ins",
"state": "enabled",
"conditions": {
"userRiskLevels": ["high"],
"signInRiskLevels": ["high"],
"applications": {
"includeApplications": ["All"]
}
},
"grantControls": {
"builtInControls": ["block"]
}
}
}Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is enabled but users who are detected as high risk are still able to sign in. What is the most likely reason?
Quick Answer
The answer is that no users or groups are assigned to the policy. A Conditional Access policy in Microsoft Entra ID requires explicit assignment of users, groups, or workload identities to take effect; without this assignment, the policy remains dormant regardless of its enabled status or risk condition settings. This is a common oversight because the policy may appear fully configured with risk levels and a block control, but if the “Users” scope is empty, it simply does not apply to any sign-in attempt. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding that policy enforcement depends on the complete chain of conditions, assignments, and controls—a frequent trap is assuming an enabled policy with risk conditions set will automatically block high-risk users. Remember the memory tip: “No users, no enforcement—assignment is the gatekeeper.”
⚠ Common exam trap
The SC-100 exam often tests the misconception that an enabled policy is automatically applied to all users, but the trap here is that the policy must have explicit assignments to take effect.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No users or groups are assigned to the policy
A Conditional Access policy must have at least one user or group assigned to it to be evaluated. If no users or groups are assigned, the policy is effectively inactive, even if enabled. In this scenario, the policy is enabled but not applied to any identities, so high-risk users are not subject to its controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
No users or groups are assigned to the policy
Why this is correct
The exhibit does not show user assignment; if none, the policy won't apply.
- ✗
The policy state is set to 'enabled' but not 'enforced'
Why it's wrong here
There is no 'enforced' state; enabled means it's on.
- ✗
The user risk level is set to 'high' but sign-in risk is 'medium'
Why it's wrong here
Both are set to high.
- ✗
The grant control is set to 'block' but should be 'require MFA'
Why it's wrong here
Block is correct for high risk.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled but users report they can still sign in from high-risk sessions. What is the most likely reason?
medium- A.The policy is not applied to all cloud apps.
- B.The policy is in report-only mode.
- ✓ C.The grant control operator is set to 'OR' instead of 'AND' with multiple controls.
- D.The policy excludes guest users by default.
Why C: The most likely reason is that the Grant control operator is set to 'OR' instead of 'AND'. When 'OR' is used, meeting any one control is sufficient for access. If the policy requires multiple controls (e.g., MFA and device compliance) to block high-risk sessions, using 'OR' allows a user who meets only one control to still sign in, even from a high-risk session. Option C is correct.
Variation 2. Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. The policy is not blocking any sign-ins even though there are high-risk users. What is the most likely reason?
medium- A.The signInRiskLevels condition is empty, so no sign-ins match.
- ✓ B.The policy does not include any users or groups in the conditions.
- C.The policy only applies to specific applications, but the exhibit shows 'All'.
- D.The grant controls operator should be 'AND' instead of 'OR'.
Why B: The Conditional Access policy JSON shows that the 'conditions' object does not include a 'users' property. Without any users or groups assigned, the policy is not evaluated against any sign-in attempts, so it never applies—even if high-risk users exist. In Microsoft Entra ID, a policy must have at least one user or group specified in the conditions to be enforced.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.