Microsoft 365 Administrator Expert MS-102 Practice Question

To require MFA only when users are off the corporate network, configure the policy so that every sign-in is evaluated except those from the trusted network, and then apply a single grant control to enforce MFA. Including Any location ensures that all sign-ins are in scope, while explicitly excluding the CorpNet named location removes on-premises traffic from evaluation. In the Grant section, select only Require multifactor authentication so the user is prompted for MFA whenever the policy applies. Including CorpNet, adding additional grant requirements, or omitting the location condition would either miss off-network traffic or introduce prompts outside the stated requirement.