Question

A company wants to allow employees to access Microsoft 365 from any location, but if a user signs in from an untrusted network, they must complete multi-factor authentication before access is granted. Which Conditional Access configuration meets this requirement?

Accepted Answer

A policy that excludes trusted locations and uses a 'Grant access' control requiring multi-factor authentication

Answer

A policy with a 'Block access' grant control applied to all locations

Answer

A policy that requires a hybrid Azure AD joined device for all sign-ins

Answer

Security defaults enabled for the entire tenant