You have an Azure Active Directory (Azure AD) tenant named contoso.com. All users who run applications registered in Azure AD are subject to…

The Client apps condition within an Azure AD Conditional Access policy is the specific control used to identify and filter authentication requests based on the client application type. To block legacy authentication, an administrator configures this condition to target "Legacy authentication clients." This category includes older mail protocols like POP, IMAP, SMTP, and other clients that do not support modern authentication. By applying a block control to sign-ins matching this condition, organizations can effectively prevent users from using these less secure protocols, thereby enhancing their security posture.

A. A cloud apps or actions condition targets specific applications (e.g., Exchange Online) or user actions, not the authentication protocol used to access them.

B. A user risk condition is part of Azure AD Identity Protection and triggers policies based on a user's compromised state, not the sign-in protocol.

D. A sign-in risk condition evaluates the real-time risk of a sign-in attempt (e.g., anonymous IP) but does not inherently filter by authentication type.

1. Microsoft Learn. (2023). Conditional Access: Conditions. In "Azure Active Directory documentation". Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#client-apps.

Reference Details: Under the "Client apps" section

the document states

"This condition allows a Conditional Access policy to target specific client applications... By configuring the client apps condition

you can distinguish between... modern authentication clients and legacy authentication clients."

2. Microsoft Learn. (2023). How to: Block legacy authentication to Azure AD with Conditional Access. In "Azure Active Directory documentation". Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication.

Reference Details: The section "Create a Conditional Access policy" explicitly instructs to navigate to Conditions > Client apps and select Legacy authentication clients to create the policy that blocks these protocols.