Exam SC-300 topic 2 question 102 discussion

C. Admin1, Admin2, and Admin3 only

When a Conditional Access policy is created from a template, the user creating the policy is automatically excluded to prevent them from being inadvertently locked out. This exclusion applies specifically when using predefined TEMPLATES. In your scenario, since Admin4 created Policy1 using the "Require multifactor authentication for Azure management" TEMPLATE, Admin4 would be excluded from the policy. Therefore, the revised answer would indeed be: C. Admin1, Admin2, and Admin3 only If the Conditional Access policy is not created from a template, the user who creates the policy is not automatically excluded.

Admin1 (Global Administrator) → ✅ Affected (requires MFA) Admin2 (Conditional Access Administrator) → ✅ Affected (requires MFA) Admin3 (Authentication Policy Administrator) → ✅ Affected (requires MFA) Admin4 (Global Administrator, but POLICY CREATOR) → ❌ Not affected - Conditional Access policies do not apply to the user who creates them (Admin4), until the next sign-in session after policy creation.

D is correct in case the admin is not excluded from this policy which does not states anywhere that Admin 4 is excluded. Again Microsoft lacking of context to the question asked

Answer B) Admin1 and Admin4 only If DEFAULT SECURITY was still in place, then ALL administrators will have MFA set to ENABLED. However, since a Conditional Access Policy is being used, then you can only go by the one conditional access policy and the roles listed here that will actually have access to the Template Management. In this case, only the Global Admins will have guaranteed access to it.

Admin2 and Admin3 not have access

when you create CA policies from template the current user who is creating them is always excluded. Hopefully this is what the question is going for