Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The requirement applies only to access to the Azure portal and other management endpoints, and MFA must be enforced everywhere except the trusted headquarters network.

Selecting the Microsoft Azure Management cloud app focuses the policy on the Azure portal, Azure PowerShell, CLI, and REST API endpoints. Including All locations and then excluding the trusted named location guarantees that any sign-in originating outside the headquarters addresses is evaluated by the policy, while sign-ins from the trusted network are ignored. Granting access with Require multi-factor authentication satisfies the need to prompt for MFA.

Using All cloud apps would unnecessarily apply the rule to every SaaS and PaaS application. Requiring a compliant device does not meet the stated MFA requirement. Enabling Security defaults adds several baseline protections, but it cannot target a specific cloud app or exempt a named location, so it would still prompt users at headquarters and would not meet the scenario constraints. Scoping the policy to Azure Resource Manager alone misses portal traffic that is covered by the broader Microsoft Azure Management identifier and therefore would not fully protect the portal.