Question

Contoso wants to require multifactor authentication only when a sign-in appears risky, while allowing users with clean sign-ins to authenticate without additional prompts. The security team requires that this policy respond in real time to Entra ID Protection's assessment of each individual sign-in attempt. You need to configure the solution using the least administrative effort. What should you do?

Accepted Answer

Create a Conditional Access policy that uses the Sign-in risk condition set to Medium and above, and grant access requiring multifactor authentication.

Answer

Create a Conditional Access policy that uses the User risk condition set to Medium and above, and grant access requiring a secure password change.

Answer

Configure an Entra ID Protection MFA registration policy scoped to all users.

Answer

Create a Conditional Access policy with no risk conditions that always requires multifactor authentication for all users.