Exam SC-300 topic 2 question 72 discussion

Include: All users Exclude: Admin1 These are the settings for the Require Password Change for High-Risk Users template: Users: All Users are Included – The current user creating the policy will be excluded Apps:All apps User Risk: Risk levels: High Access Control: Grant access – Require multifactor authentication AND Require password change Conditional Access template policies will exclude only the user creating the policy from the template. If your organization needs to exclude other accounts, you will be able to modify the policy once they are created. You can find these policies in the Microsoft Entra admin center > Protection > Conditional Access > Policies. Select a policy to open the editor and modify the excluded users and groups to select accounts you want to exclude. https://sccmentor.com/2023/03/26/just-dropped-in-to-see-what-condition-my-conditional-access-rule-was-in-part-6-require-password-change-for-high-risk-users/ https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policy-common?tabs=zero-trust#template-categories

Wrong answer. Include: All Users Exclude: Current User (Admin1 in this case) Tested in lab. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk-user

Include: All Users Exclude: Admin1 (current user, which is already inside all users)

Just tested. Include: All Users, Exclude: Current User

Include: None Exclude: None The default settings when creating any new CA policy: Users 0 users and groups selected Control access based on who the policy will apply to, such as users and groups, workload identities, directory roles, or external guests. Include - None : default - All users - Select users and groups Exclude Select the users and groups to exempt from the policy - Guest or external users : Unchecked - Directory roles : Unchecked - Users and groups : Unchecked Policy can be enforced with "Enable policy".

-All users -All guest and external users My thinking: The reason for excluding these is because they login with external credentials! We do not manage their identity and therefore cannot enforce a PW reset? Also in the real world I would exclude the breakglass account also (as mentioned in ms documentation)

- All users - All guest and external users

The correct is: Include: All Users Exclude: Current User (Admin1 in this example)

All User & none... Microsoft even warns you in their Docs to Test CAPs in Report only Mode before you Lock yourself Out And logically If you say all User in the First place you cant say anything Else the none as 2nd answer because the First answer wouldnt be all the ;)

- All users - All guest and external users