AZ-140: Configuring and Operating Microsoft Azure Virtual DesktopDemo

By Microsoft · Question Mode

QuestionQ178

Plan and implement identity and security

Your company has the offices shown in the table.

Question Image

The company has an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.

Users connect to an Azure Virtual Desktop deployment named WVD1. WVD1 contains session hosts that have public IP addresses from the 52.166.253.0/24 subnet.

Contoso.com has a conditional access policy that has the following settings:

  • Name: Policy1
  • Assignments:
    • Users and groups: User1
    • Cloud apps or actions: Azure Virtual Desktop
  • Access controls:
    • Grant: Grant access, Require multi-factor authentication
  • Enable policy: On

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Yes or No
StatementsYesNo
If User1 connects to Azure Virtual Desktop from the office in Boston, User1 is prompted for multi-factor authentication (MFA).
If User1 connects to Azure Virtual Desktop from home, User1 is prompted for multi-factor authentication (MFA).
If User1 connects to Microsoft Exchange Online from a Azure Virtual Desktop session, User1 is prompted for multi-factor authentication (MFA).
Explanation

Policy1's conditions only specify the assigned user (User1) and the cloud app (Azure Virtual Desktop); no Locations condition is configured, so the policy is enforced regardless of whether the connection originates from the Boston office, the Seattle office, or home — MFA is required in every case when User1 signs in to the Azure Virtual Desktop service (app ID 9cdead84-a844-4324-93f2-b2e6bb768d07), which covers feed subscription and gateway authentication. Accessing Microsoft Exchange Online from inside a running AVD session is a sign-in to a completely different Azure AD-registered application than Azure Virtual Desktop; because Policy1's Cloud apps assignment lists only Azure Virtual Desktop, it does not extend to Exchange Online sign-ins, so no MFA prompt from Policy1 is triggered for that access unless a separate Conditional Access policy specifically targets Exchange Online.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!