Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Conditional Access lets you scope a policy to Azure AD privileged roles by selecting the Directory roles option under Users and groups. After you pick the relevant built-in roles-such as Global Administrator, Security Administrator, or Privileged Role Administrator-the policy automatically applies to anyone who is added to those roles in the future, eliminating the need to manage individual user or group assignments. Selecting All users would also affect non-privileged accounts, choosing Azure management scopes the policy to a specific application rather than a set of users, and configuring a High sign-in risk condition does not limit the policy to privileged roles.