AZ104-Q: Requiring MFA from untrusted locations
Q: You must require multifactor authentication (MFA) for all users when they sign in from locations outside your corporate network. Which mechanism should you use?
- A) Remove RBAC permissions from remote users
- B) A Conditional Access policy that grants access only when MFA is completed ✓
- C) A storage account firewall
- D) An Azure Policy with a
Denyeffect
Answer: B — Conditional Access. Conditional Access is the policy engine that enforces authentication requirements based on signals such as location, device state, and risk. You create a policy scoped to the All users group that requires MFA, and either block or grant access with MFA for the “outside corporate network” location. RBAC controls authorization (what a signed-in user may do), not how they authenticate, so it cannot enforce MFA. Policy (D) governs resource configuration, not sign-in.
Why it helps
MFA is enforced with Conditional Access (or Security defaults). Distinguish it from RBAC (authorization) and Azure Policy (resource config) — all three are frequently tested together.