hardMultiple ChoiceObjective-mapped

Conditional Access Report-Only Mode: Why MFA Is Not Prompted

Exhibit

{
  "policy": {
    "tenantId": "contoso.onmicrosoft.com",
    "displayName": "Require MFA for all users",
    "state": "enabled",
    "conditions": {
      "applications": {
        "includeApplications": ["All"]
      },
      "users": {
        "includeUsers": ["All"]
      }
    },
    "grantControls": {
      "builtInControls": ["mfa", "compliantDevice"]
    }
  }
}

Refer to the exhibit. You are reviewing a Conditional Access policy in Azure AD. The policy requires MFA and a compliant device for all users and all cloud apps. Some users report that they are able to access apps without being prompted for MFA even though their devices are compliant. What is the most likely reason?

Quick Answer

The answer is that the Conditional Access policy is set to 'Report-only' mode. This is the most likely reason MFA is not being prompted because report-only mode evaluates the policy conditions and logs the results in the sign-in logs, but it never enforces any access controls—meaning it will not block access or require MFA, even if a user’s device is compliant. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of the Conditional Access lifecycle, where report-only mode is used for safe testing before switching to enforcement. A common trap is assuming that a compliant device alone triggers MFA, but the policy mode overrides all grant controls. Memory tip: think of report-only as a “fire drill” that sounds the alarm but never locks the doors—it logs what would happen without actually stopping anyone.

⚠ Common exam trap

The trap here is that candidates may overlook the 'Report-only' mode setting and assume the policy is enforcing controls, focusing instead on app scope or location exclusions, which are common red herrings in Conditional Access troubleshooting questions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is set to 'Report-only' mode

A Conditional Access policy set to 'Report-only' mode evaluates the policy and logs results but does not enforce any controls, such as requiring MFA or a compliant device. Users can access apps without MFA prompts because the policy is not actively blocking or challenging them, even if their devices are compliant. This mode is used for testing before enabling enforcement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not include all cloud apps
Why it's wrong here
The policy includes 'All' applications.
✓
The policy is set to 'Report-only' mode
Why this is correct
In report-only mode, policies are not enforced, so users are not prompted for MFA.
✗
The policy excludes specific locations
Why it's wrong here
No location exclusion is shown in the policy.
✗
The policy does not include session controls to enforce MFA re-prompt
Why it's wrong here
Session controls are not required for MFA; the grant control itself triggers MFA.

Go deeper

1 more way this is tested on SC-100

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

medium

A.Azure AD Connect is not configured for Pass-through Authentication
B.The Conditional Access policy does not include session controls
C.The Conditional Access policy is not targeting the correct user group
✓ D.Users are using legacy authentication protocols that do not support MFA

Why D: The most likely reason is that users are using legacy authentication protocols (e.g., POP3, IMAP, SMTP, or older Office clients) that do not support modern authentication and thus cannot enforce MFA via Conditional Access. Even though the policy requires MFA, legacy protocols bypass the Conditional Access engine entirely, allowing authentication without MFA prompts.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.

Conditional Access Report-Only Mode: Why MFA Is Not Prompted

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on SC-100