Conditional Access Rollout for a Hybrid Workforce
Contoso has 4,200 employees. 1,800 work fully remote on unmanaged Windows 11 laptops; the rest use domain-joined desktops in three offices. The security team wants to enforce MFA for all cloud app access but has received complaints: field sales staff lose connectivity in areas with poor signal and cannot complete push notifications. The CISO also wants to block legacy authentication because sign-in logs show 12% of authentications still use IMAP. Finance has a hard requirement that a subset of 40 users who administer payroll must re-authenticate every 8 hours regardless of device. The team has Microsoft Entra ID P1 licenses only. A junior admin proposes a single Conditional Access policy applying MFA to all users and all cloud apps, plus a named location for the office IP ranges.
1. Evaluate the junior admin's single-policy proposal. What risks and gaps does it introduce given the stated constraints?
Read the worked answer
A single 'all users, all cloud apps, require MFA' policy is a blunt instrument and creates three concrete problems:
- Legacy auth bypass. Conditional Access policies do not evaluate legacy authentication protocols by default in the way modern auth is evaluated; IMAP/SMTP/POP clients will still authenticate unless a separate policy targets 'Other clients' (legacy) client apps and blocks them. The 12% IMAP traffic would remain unprotected. A dedicated block-legacy-auth policy is required.
- No device or location differentiation. The field sales poor-connectivity issue is not solved by a blanket MFA policy. The better approach is to exclude trusted named locations (office IPs) from MFA and to use authentication strengths or a phishing-resistant method for admins, while allowing alternative methods for the remote sales group.
- The 8-hour re-auth requirement is not met. MFA alone does not force re-authentication on a schedule; sign-in frequency must be configured in a session control (sign-in frequency = 8 hours) scoped to the payroll admin group. That is a separate policy.
Also note licensing: P1 covers Conditional Access, but risk-based conditions (sign-in risk, user risk) require P2. The design must avoid risk-based conditions or the org must upgrade. Recommended structure: (a) block legacy auth for all, (b) require MFA for all users excluding trusted locations, (c) sign-in frequency 8h for payroll admins, (d) a break-glass exclusion account excluded from all policies.
2. The sales team cannot reliably complete push notifications. Which Conditional Access design choice best balances security and usability without weakening the MFA requirement for everyone else?
Read the worked answer
Use targeted policy scoping plus authentication method flexibility, not a global weakening:
- Create a dedicated policy scoped to the sales group (or a dynamic group) that still requires MFA but permits methods that work offline or with poor connectivity - for example, allowing a Temporary Access Pass for onboarding and favoring methods that don't depend on a live push (e.g., number matching with a fallback, or FIDO2 security keys which work without network for the local gesture).
- Exclude trusted named locations so office-based users are not prompted repeatedly.
- Do not simply exclude the sales group from MFA - that creates an unmanaged population and defeats the control.
- Consider a session control (e.g., limited access / app-enforced restrictions) so that if MFA cannot be completed, the user gets reduced access rather than full block or full access.
The judgment point: the exam tests that you solve usability by scoping and method selection, not by removing the control for an entire population.