Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 721:

  You need to recommend a solution to automate the configuration for the finance department users. The solution must meet the technical requirements.

  What should you include in the recommendation?

  A. Azure AP B2C

  B. Azure AD Identity Protection

  C. an Azure logic app and the Microsoft Identity Management (MIM) client

  D. dynamic groups and conditional access policies

  Correct Answer: D

  Scenario: Ensure Azure Multi-Factor Authentication (MFA) for the users in the finance department only.

  The recommendation is to use conditional access policies that can then be targeted to groups of users, specific applications, or other conditions.

  Technically, The finance department needs to migrate their users from AD to AAD using AADC based on the finance OU, and need to enforce MFA use. This is conditional access policy. Employees also often get promotions and/or join other departments and when that occurs, the user's OU attribute will change when the admin puts the user in a new OU, and the dynamic group conditional access exception (OU= [Department Name Value]) will move the user to the appropriate dynamic group on next AADC delta sync.

  References: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamicmembership https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview