Exam AZ-300 topic 16 question 3 discussion

A. From Azure Active Directory (Azure AD), configure organizational relationships. Nope B. From the MFA service settings, create a trusted IP range. Yepp, that would solve the problem. See this link: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips C. From Conditional access in Azure Active Directory (Azure AD), create a custom control. I have no idea what a "custom control" should be in this context. Maybe it's made up? D. From Conditional access in Azure Active Directory (Azure AD), create a named location. Adding the companies public IP address ranges as named location wouldn't help to disable MFA. With named locations you can mark IPs and ranges as "trusted locations" which lowers a user's sign-in risk. So B. is correct!

Given answer is correct

D is not correct, because setting named location is not sufficient. You still need additional set to exclude that named location in the policy -> conditions sections

was very confused initially but then https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#named-locations Read the section on "Skipping multi-factor authentication". Still is trusted IP range. I would go with (B)

B is the right answer. We can go to MFA service page and enable trusted IP ranges

Answer is D even their answer explanation said so

IP based is very common. Note that AD is capable of identifying your location (location means where you are connecting from ... it is IP address, not street number:-)). If you are connecting from a "trusted" environment, then no need for multi-factor (given that you are on premises / more controlled environment). Answer is "trusted IP" which is the IP of the location where the request came from.

B seems to be correct answer as D is saying about creating a named location. If you create a named location then you have add trusted IP range to get it work. Same it mentions in explanation. In future there is going to single blade for all this. https://portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/NamedNetworksV2

Read the statement carefully "From Conditional access in Azure Active Directory (Azure AD), create a named location". You DO NOT create a named location from conditional access; you only select a named location. If you selected TRUSTED IPs, you would still need to go the answer B to configure the trusted ip. So correct answer is B.

According to the below, it's B Location Conditional Access Policy: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition "Requiring multi-factor authentication for users accessing a service when they are off the corporate network. Blocking access for users accessing a service from specific countries or regions." Trusted IP's: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#trusted-ips "You can set trusted IP ranges for your on-premises environments to when users are in one of those locations, there's no Azure Multi-Factor Authentication prompt."

answer is B not to confuse with named location

B is correct based on the link https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings

Here we go ladies and gents, a couple of links that I think validate choice "D" as the correct choice. In summary, you have to go through Named Location in order to get to trusted IPs. Screen shots included in links. https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-configure-named-locations https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

Correct answer is B as it talks of addressing the second authentication which is done on MFA then navigate to MFA service settings D is not considering MFA. It addresses access (password and/or MFA) based on trusted locations where users are allowed to login. If a user is not on the trusted location, then are blocked from accessing the service. (Doesn't consider MFA status)

The given answer is a quickest way. So you can just add ip address or range to the section in MFA --> Configure--> Additional cloud-based MFA settings: From the trusted ips tab add ips

What about: https://www.kraftkennedy.com/implementing-azure-multi-factor-authentication/ Here it seems that with MFA the Trusted IP is OK.

The answer is D https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition