Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Exhibit

Refer to the exhibit.

{
  "properties": {
    "displayName": "Require MFA for admins",
    "state": "enabled",
    "conditions": {
      "applications": {
        "includeApplications": ["All"]
      },
      "users": {
        "includeRoles": ["Global Administrator"]
      }
    },
    "grantControls": {
      "builtInControls": ["mfa"]
    }
  }
}

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

⚠ Common exam trap

A common mix-up: candidates assume 'All users' includes all users regardless of role, but they overlook that the exclusion of specific roles or users can completely bypass the policy, and the exam tests whether you understand that exclusion rules override inclusion rules in Conditional Access policies.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy does not include any users except by role.

The Conditional Access policy JSON shows that the 'users' object does not include an 'includeUsers' property for all users or specific groups; instead, users are only included by directory role (e.g., through 'includeRoles'). If the 'includeRoles' array is either empty or does not contain the 'Global Administrator' role, then Global Administrators are not targeted by the policy. Therefore, they are not prompted for MFA despite the policy being enabled. This is the most likely reason because the other options are incorrect: the policy may include applications (option B), the grant control could be set to MFA (not requiring compliant device) (option C), and the policy is enabled (option D).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The policy does not include any users except by role.
Why this is correct
The conditional access policy defines user targeting exclusively through the includeRoles array and omits the includeUsers array entirely. This means the policy only applies to sign-ins from users assigned to the specified directory roles, leaving every non-role user outside the policy scope. The absence of an includeUsers entry, such as the shortcut value 'All', prevents the policy from being universally enforced and is the root cause of the misconfiguration.
✗
The policy does not include any applications.
Why it's wrong here
The policy JSON clearly specifies an includeApplications array containing the value 'All', which is a reserved identifier that encompasses every cloud application registered in the tenant. The presence of this condition means the policy is application-scoped to all apps, not zero apps. Therefore, the assertion that no applications are included is factually incorrect when reading the conditions.applications block.
✗
The grant control requires a compliant device instead of MFA.
Why it's wrong here
Within the grantControls object, the builtInControls array is set to ['mfa'], and the operator is 'OR', indicating that the policy requires multi-factor authentication as the sole grant control. There is no reference to 'compliantDevice' or 'requireDeviceCompliance' anywhere in the grant section, so the policy cannot be said to be demanding a compliant device. The claim conflates MFA with device compliance, which are distinct conditional access grant options.
✗
The policy state is disabled.
Why it's wrong here
The state property in the policy JSON is explicitly set to 'enabled', which means the policy is actively being enforced by the Conditional Access engine for all matching sign-in attempts. A policy with this state is live during authentication, whereas a disabled policy would have state set to 'disabled' or possibly be in report-only mode with 'enabledForReporting'. Therefore, the statement that the policy is disabled is demonstrably false and would misrepresent the policy's operational status.

Go deeper

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question