Question

Contoso reports repeated password-spray attacks succeeding against Exchange Online mailboxes. Investigation shows the attackers authenticate using IMAP and POP3 clients that do not present multi-factor authentication prompts. You must stop these attacks while allowing modern Outlook and Teams clients to continue working. Which Conditional Access configuration should you deploy?

Accepted Answer

Create a policy targeting all users and cloud apps, with the client apps condition set to 'Exchange ActiveSync clients' and 'Other clients', and set the grant control to Block.

Answer

Create a policy targeting all users and cloud apps that requires multi-factor authentication for all client apps.

Answer

Create a policy targeting all users that requires a compliant device for browser client apps only.

Answer

Create a policy that requires password change for users flagged as high risk in Entra ID Protection.