Security requires MFA only when users sign in from outside the corporate network — not when on-premises. Which Entra ID feature enforces this if/then logic?
A.Identity Protection risk policies
Risk policies react to leaked-credential/impossible-travel signals — not the general if/then mechanism.
B.Conditional Access
Conditional Access = signal-based policy engine. Correct.
C.Access reviews
Access reviews recertify access — not sign-in conditions.
D.Privileged Identity Management
PIM governs privileged role elevation, not routine sign-in rules.
Why this answer
Conditional Access is the if/then policy engine: signals (location, device, app, risk) → controls (MFA, block, compliant device). Requires P1. PIM is just-in-time privileged role activation; access reviews recertify group/role membership.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Governance practice session.
Practice Identity & Governance