Question

Your organization uses a custom line-of-business SharePoint site that contains highly sensitive financial records. Users can already access other SharePoint content after satisfying a baseline Conditional Access policy requiring MFA. Security requires that when users open the sensitive financial site specifically, they must re-authenticate with a phishing-resistant method (FIDO2), even if they already have an active session. You need to enforce this step-up requirement only for that site without affecting access to the rest of SharePoint. What should you configure?

Accepted Answer

Create an authentication context, tag the sensitive site with it via a sensitivity label, and build a Conditional Access policy that targets the authentication context and requires an authentication strength allowing only FIDO2.

Answer

Modify the existing baseline Conditional Access policy to require FIDO2 for all SharePoint access using the Office 365 cloud app assignment.

Answer

Configure a Conditional Access policy targeting the SharePoint Online cloud app with sign-in frequency set to every time and require MFA.

Answer

Create a named location for the site's URL and build a Conditional Access policy requiring a compliant device when that location is accessed.