Question

Contoso's security team reports that sign-in attempts are originating from a country where the company has no employees or business operations. Legitimate users only sign in from the United States and Canada. You need to prevent all authentication from the unauthorized country while allowing normal operations to continue, using the least administrative effort. What should you do?

Accepted Answer

Create a country-based named location containing the unauthorized country, then create a Conditional Access policy that blocks access for that location.

Answer

Create a named location for the United States and Canada marked as trusted, then enable a per-user MFA registration policy.

Answer

Configure an Entra ID Protection sign-in risk policy that requires MFA for all high-risk sign-ins.

Answer

Add the unauthorized country's IP ranges to the tenant-wide allowlist and enable Smart Lockout.