Contoso notices a spike in sign-ins from unfamiliar countries and Tor exit nodes targeting Microsoft 365. Some users legitimately travel, and the CIO…

Conditional Access policies in Microsoft Entra ID are designed to balance security and user productivity. Using risk-based policies allows the organization to apply stricter controls, such as requiring Multi-Factor Authentication (MFA), only when a sign-in is deemed risky (e.g., from an anonymous IP address, unfamiliar location, or infected device). This approach directly meets the requirement to respond to threats without inconveniencing users during normal, low-risk sign-ins. It avoids overly broad restrictions like blocking entire countries or forcing MFA on every login, aligning with the principle of least privilege and adaptive access control.

A. This is too restrictive and conflicts with the requirement to allow legitimate travel. It lacks the intelligence to differentiate between risky and legitimate foreign sign-ins.

B. This conflicts with the CIO's explicit desire not to force MFA for every single sign-in, as it would negatively impact the user experience for low-risk access.

D. Security defaults are a baseline protection and are less flexible than Conditional Access. Disabling Conditional Access would remove the granular control needed to target only risky sign-ins.

1. Microsoft Entra documentation

"What is Conditional Access?". Section: "Common signals". This page lists sign-in risk as a key signal that Conditional Access can use to make policy decisions.

2. Microsoft Entra documentation

"Conditional Access: Sign-in risk-based Conditional Access". This document explicitly states

"Microsoft Entra ID Protection detects risks on user sign-ins... Organizations can configure sign-in risk-based Conditional Access policies to require access controls such as... multifactor authentication."

3. Microsoft Entra documentation

"Common Conditional Access policies". The policy template "Require multifactor authentication for risky sign-ins" directly implements the solution described in the correct answer.