Exam SC-300 topic 2 question 84 discussion

For a CA they say: Remember, the exclusion will take precedence. So if you select to include a user then exclude the user, the user will be excluded from the policy.

Not sure about User1 ? User2 and User3 are clearly exluded from the policy and so are not required to change password. User1 however has a HIGH user risk, but the policy is about sign-in, I think it is not supposed to trigger ? I would say NNN

Yes) User1 is part of Group1 and has HIGH sign-in risk No) User2 is excluded from risk policy because they are part of Group2 No) User3 is part of Group1 and they are HIGH risk, but they are also part of Group2 and are excluded from the risk policy. This EXCLUDE is important to understand. EXCLUDE takes precedence for any policy, just like when you want to exclude your ADMIN accounts so that you don't get locked out of a very restrictive rule/policy.

User1 must change their password? ✅ Yes User2 must change their password? ❌ No User3 must change their password? ❌ No Since User3 is in both groups, exclusion takes priority, meaning User3 is excluded from the policy and does not have to change the password.

When organizations both include and exclude a user or group, the user or group is excluded from the policy. The exclude action overrides the include action in policy. Exclusions are commonly used for emergency access or break-glass accounts. User1 must change his password, cause Group1 is included in risk policy and his risk level is High. User2 does not need to change his password, cause Group2 is excluded from risk policy. User3 would not be required to change their password during sign-in. Here’s why: Inclusion and Exclusion: User3 is a member of both Group1 and Group2. Since Group2 is excluded from the policy, the policy does not apply to User3. Sign-in Risk Level: Even though User3’s sign-in risk level is High, the exclusion from Group2 takes precedence. https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups#exclude-users

What is the precedence of Conditional Access policy? Understanding Policy Precedence When you have several policies enabled, the policy precedence is the following: A policy set to deny access is first priority. A policy set to allow access with MFA is second priority. A policy set to allow access without MFA is third priority. YNY

i' m not sure for user 3