Continue your lesson
Trace the identity, credential, token, assignment, policy decision, resource, and audit record for each access request.
Block 1 of 5Compare Conditional Access policy · Grant control
Current · 12 min
Compare Conditional Access policy · Grant control
Optional concept notes
Conditional Access policy
Combines assignments conditions and access controls to evaluate a sign-in.
Grant control
Requires controls such as MFA compliant device or an approved authentication strength.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 2 of 5Compare Report-only mode · Conditional Access What If · Emergency account exclusion · Named location
18 min
Compare Report-only mode · Conditional Access What If · Emergency account exclusion · Named location
Optional concept notes
Report-only mode
Evaluates and logs a Conditional Access policy without enforcing its controls.
Conditional Access What If
Tests which policies would apply to a supplied sign-in scenario.
Emergency account exclusion
Keeps monitored break-glass identities outside policies that could lock out administrators.
Named location
Represents configured IP ranges or countries for Conditional Access conditions.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 3 of 5Compare Conditional Access device filter · Session control · Continuous Access Evaluation
18 min
Compare Conditional Access device filter · Session control · Continuous Access Evaluation
Optional concept notes
Conditional Access device filter
Includes or excludes devices by evaluated device properties inside a policy.
Session control
Limits an allowed session through sign-in frequency app enforcement or related controls.
Continuous Access Evaluation
Lets supported services react quickly to critical identity and policy events during a session.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 4 of 5Compare Conditional Access authentication context · Protected action
12 min
Compare Conditional Access authentication context · Protected action
Optional concept notes
Conditional Access authentication context
Applies a policy requirement when a protected application action requests a labeled context.
Protected action
Requires a selected Conditional Access authentication context before a sensitive directory operation.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 5 of 5Understand Device-enforced restriction
10 min
Understand Device-enforced restriction
Optional concept notes
Device-enforced restriction
Limits supported application behavior based on managed device signals and session controls.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Practice the reasoning here
Use a fictional tenant. Draw one access path, apply least privilege, test an exception, and name the logs that would confirm the result.
- State the expected result before changing or testing anything.
- Name the observation, command, log, or report that would confirm it.
- Explain why the closest alternative does not fit the same requirement.
Check the whole objective
This unlocks objective 2.2 for recall. The latest checkpoint needs 70% or higher; a lower result puts the lesson back near the front of your timeline.