Microsoft Azure Security Engineer Associate AZ-500 Practice Question

A Conditional Access policy can target all users, set the Grant control to Require multi-factor authentication, and exclude a named location that lists the office IP range as a trusted location. With this approach, any sign-in originating from outside the trusted range triggers MFA, while sign-ins from the corporate network are allowed without additional prompts. Security defaults always apply the same baseline rules and cannot be customized to ignore specific IP ranges. Enabling per-user MFA would require you to manage the setting on every account and is considered a legacy approach. The Azure AD Identity Protection user-risk policy is driven by calculated risk levels, not by network location, so it cannot selectively enforce MFA based solely on IP address.