Question

Contoso has a SharePoint Online document library named 'Financials' that contains highly sensitive files. Users may already have an active session to SharePoint after signing in with a password. Security requires that when a user attempts to open a file specifically in the 'Financials' library, they must satisfy multifactor authentication at that moment — even if they authenticated with only a password earlier in the session. Regular access to other SharePoint sites should not be affected. Which combination should you configure to enforce this granular, on-demand step-up?

Accepted Answer

Create a sensitivity label with an authentication context, publish it, apply it to the 'Financials' library, and create a Conditional Access policy targeting that authentication context requiring MFA.

Answer

Create a Conditional Access policy targeting the Office 365 SharePoint Online cloud app for all users requiring MFA, and enable app-enforced restrictions.

Answer

Configure a sign-in frequency session control of 1 hour on a Conditional Access policy scoped to all users accessing SharePoint Online.

Answer

Create a Conditional Access policy that uses a filter for devices and requires compliant devices when accessing SharePoint Online.