Conditional Access practice questions
Fifteen free Conditional Access practice questions with explained answers, written as short scenarios in the style of Microsoft identity exams. Conditional Access is the Microsoft Entra policy engine that decides, after first-factor sign-in, whether to block access, allow it, or allow it only with extra requirements such as MFA or a compliant device. It is tested in SC-300, SC-900 and AZ-900, among others.
How to use these questions
Answer each question before opening the explanation, and commit to one letter. Note the constraint word in the stem (“only when”, “without affecting”, “block”, “least”), because that word usually decides between two plausible options. Read the explanation of every option, not only the right one, since the wrong options are the traps the exams reuse. The guide Conditional Access explained covers the theory behind all fifteen.
Warm-up: how policies are built
Question 1. Policy A requires multifactor authentication for all users of Microsoft 365. Policy B requires a compliant device for the Finance group. Both are enabled, and a Finance user signs in to Exchange Online. What must the user satisfy?
- A. Only MFA, because the broader policy takes precedence
- B. Only a compliant device, because the narrower policy takes precedence
- C. Both MFA and a compliant device
- D. Whichever requirement the user satisfies first
Show answer
Answer: C
Policies have no priority order and do not override each other. Every enabled policy whose assignments match the sign-in must be satisfied, so the Finance user needs both MFA and a compliant device. Satisfying only the stricter or only the broader policy is not enough, and the lower policy in the list does not win because there is no list order.
Question 2. You are about to create a policy that requires MFA for all users. You want to see how many sign-ins it would affect without prompting anyone. What should you do?
- A. Set the policy state to report-only
- B. Set the policy state to on and watch the sign-in logs
- C. Exclude all users from the policy
- D. Change the grant control to block access
Show answer
Answer: A
Report-only mode evaluates the policy and logs the result in the sign-in logs without enforcing it, which is the standard way to test a new policy. Enabling the policy enforces it immediately. Excluding all users makes it match nothing, so it would produce no useful data. Setting the grant control to block is the opposite of the requirement and would lock users out.
Question 3. A new policy blocks sign-ins to all cloud apps from outside the company's countries. The directory has two emergency access (break-glass) accounts. What is the recommended handling of those accounts?
- A. Include them in the policy so that they are protected like other accounts
- B. Assign them the Global Administrator role, which bypasses policies
- C. Disable them until the policy is confirmed to work
- D. Exclude them from the policy and monitor their use
Show answer
Answer: D
Emergency access accounts exist to restore access when normal administration fails, so they are excluded from Conditional Access policies that could lock every administrator out. Including them defeats their purpose. Assigning them an Entra role does not exempt them from policy. Disabling the accounts leaves no way back into the tenant.
Question 4. A colleague describes Conditional Access as a firewall in front of the Microsoft Entra sign-in page. At which point is Conditional Access actually enforced?
- A. Before the user is shown the sign-in page
- B. After first-factor authentication has completed
- C. Only when an access token is revoked
- D. Only when the user changes a password
Show answer
Answer: B
Conditional Access policies are enforced after the first-factor authentication has completed, using the collected signals to decide on blocking or additional requirements. It is therefore not a pre-authentication filter. It does not run before the user enters credentials, and it is not applied only when a token is revoked or only when a password changes.
Question 5. A company wants a policy that requires MFA when the sign-in risk is medium or high. Which licence provides the sign-in risk condition?
- A. Microsoft Entra ID Free
- B. Microsoft Entra ID P1
- C. Microsoft Entra ID P2
- D. Security defaults
Show answer
Answer: C
Risk-based conditions come from Microsoft Entra ID Protection, which is a Microsoft Entra ID P2 feature. Free provides only basic features, and security defaults are a fixed set of baseline settings, not a policy condition. P1 provides Conditional Access itself, with conditions such as location and device, but not the risk signals.
Scenarios: choosing controls and diagnosing results
Question 6. A block policy for the Contractors group exists. A second policy named Allow contractors with MFA grants access to the same group after MFA. A contractor completes MFA but is still blocked. The contractor must be able to sign in. What should you do?
- A. Raise the priority of the grant policy above the block policy
- B. Exclude the contractor from the block policy
- C. Add a compliant device requirement to the grant policy
- D. Delete the grant policy
Show answer
Answer: B
A block control always wins: no grant policy can override it. The fix is to remove the contractors from the scope of the block policy, for example with an exclusion, or to narrow the block condition. Adding more grant requirements, raising a priority (there is none) or deleting the grant policy does not lift a block.
Question 7. Users on unmanaged devices must be able to open SharePoint Online files in the browser, but must not be able to download or print them. Which Conditional Access control meets the requirement?
- A. The grant control Block access
- B. The grant control Require multifactor authentication
- C. The grant control Require terms of use
- D. The session control Use app enforced restrictions
Show answer
Answer: D
The session control Use app enforced restrictions passes the device state to SharePoint Online, which then limits the browser experience (no download, print or sync). Blocking access would stop all access. Requiring MFA or accepting terms of use still allows full download once the requirement is met.
Question 8. A user says they were prompted for MFA yesterday but not today, and the helpdesk wants to know which policies applied to the latest sign-in. Where should the helpdesk look?
- A. The Conditional Access tab of the sign-in log entry
- B. The Azure Activity log of the subscription
- C. The audit log entry for the user’s creation
- D. The Entra Connect health blade
Show answer
Answer: A
The sign-in log has a Conditional Access tab for each sign-in that lists the policies evaluated and their result. The What If tool simulates a sign-in for given conditions, which also helps but does not show the actual sign-in. The audit log records configuration changes, and the Azure Activity log covers Azure resources, not Entra sign-ins.
Question 9. Legacy protocols such as SMTP AUTH and old Exchange ActiveSync clients cannot perform MFA. You must stop sign-ins that use them for all users. Which policy configuration achieves this?
- A. Condition Browser clients, grant control Block access
- B. Condition Other clients, grant control Require multifactor authentication
- C. Condition Exchange ActiveSync clients and Other clients, grant control Block access
- D. Condition Other clients, grant control Require compliant device
Show answer
Answer: C
Legacy authentication is identified through the client apps condition (Exchange ActiveSync clients and Other clients). Combined with the Block access grant control it stops those sign-ins. Requiring MFA cannot work because these clients cannot complete it. Targeting only modern browser clients leaves the legacy clients untouched. A compliant device requirement is not about the protocol.
Question 10. Guest users invited through B2B collaboration must use MFA for every cloud app. Employees must not be affected. How should the policy be assigned?
- A. Include All users and exclude Guest or external users
- B. Include Guest or external users and select the B2B collaboration guest type
- C. Assign the guests the Reader role
- D. Include All users and require MFA only in the session controls
Show answer
Answer: B
The Users assignment can include Guest or external users, with the types selected, and the policy then applies only to them. Including all users would prompt employees. A role assignment to the guests changes permissions, not sign-in requirements. Excluding guests would do the reverse of the requirement.
Edge cases and traps
Question 11. A policy lists two grant requirements: Require multifactor authentication and Require device to be marked as compliant. Users should be admitted when they satisfy either requirement. The policy currently demands both. What should you change?
- A. Add a second policy with only the MFA requirement
- B. Switch the policy to report-only
- C. Move half of the users into an excluded group
- D. Select Require one of the selected controls
Show answer
Answer: D
With several grant controls selected, the policy defaults to Require all the selected controls. Switching to Require one of the selected controls admits users who meet either. Adding a second policy keeps both requirements because all matching policies must be satisfied. Splitting users into groups or using report-only mode does not change what the grant demands.
Question 12. A user is signed in to an application that does not support continuous access evaluation. An administrator adds the user to a group targeted by a new policy that requires a compliant device. The user is not interrupted. Why?
- A. The existing token stays valid until it expires or is refreshed
- B. Group-targeted policies only apply to users created after the policy
- C. Compliant device requirements apply only to mobile devices
- D. The policy must be set to report-only for membership changes
Show answer
Answer: A
Policies are evaluated when a token is issued. The existing access token remains valid until it expires or is refreshed, and an application without continuous access evaluation does not recheck in between. The policy is not broken, group membership is not ignored for ever, and the requirement does not apply only to new devices.
Question 13. A policy requires MFA for all locations except all trusted locations. Remote staff connect through the company VPN, whose egress public IP is not defined anywhere in Entra, and are still prompted for MFA. They should not be. What should you do?
- A. Delete the policy and rely on per-user MFA
- B. Add a second grant control that requires a compliant device
- C. Create an IP ranges named location for the VPN egress addresses and mark it as trusted
- D. Lower the user risk level in ID Protection
Show answer
Answer: C
The policy treats a sign-in as trusted only if its IP matches a named location marked as trusted. Adding the VPN egress range as a named location and marking it trusted makes the exclusion match. Requiring MFA in the grant control does nothing for trust, deleting the policy removes the protection for everyone, and the user risk level is unrelated to the network location.
Question 14. Security defaults are enabled in a tenant. An administrator tries to create a Conditional Access policy that requires MFA for administrators and cannot enable it. What is the reason?
- A. Only one Conditional Access policy can target administrators
- B. Security defaults must be disabled before Conditional Access policies can be enabled
- C. A named location must exist before any policy can be enabled
- D. An emergency access account must be created first
Show answer
Answer: B
Security defaults and Conditional Access policies cannot be combined: to use Conditional Access policies, security defaults must be disabled first. The policy is not blocked by the number of existing policies, by a missing named location, or by an absent emergency account, although creating emergency accounts is good practice.
Question 15. Administrators must sign in with FIDO2 security keys, Windows Hello for Business or certificate-based authentication. Sign-ins that use MFA by SMS or a phone call must not be accepted. Which grant control fits?
- A. Require multifactor authentication
- B. Require device to be marked as compliant
- C. Require password change
- D. Require authentication strength, using Phishing-resistant MFA
Show answer
Answer: D
The Require authentication strength control with the built-in Phishing-resistant MFA strength accepts only methods such as FIDO2, Windows Hello for Business and certificate-based authentication. Plain Require multifactor authentication also accepts SMS and phone calls. A compliant device concerns the device, not the method, and a password change requirement is unrelated to the method.
Where to go next
Review the theory in Conditional Access explained, then continue with Azure RBAC practice questions and Zero Trust and IAM practice questions. The free 20-question SC-300 practice test mixes this topic with the rest of the exam, and multiple-choice exam tips cover how to handle the constraint words.