A botanical-garden platform team can still open the Azure portal from a coffee shop with only a password. Which Conditional Access policy shape enforces MFA for Azure management while sparing break-glass accounts?
Select an answer to reveal the explanation.
Short Explanation
Build the classic if-then: these users (minus the sealed break-glass pair), this Azure management app, then require MFA. That stops coffee-shop password-only portal logins without inventing a Zero Trust essay or waiting on Security Copilot.
Full Explanation
A Conditional Access policy for Azure cloud resource management typically includes the target user set (excluding emergency access accounts), assigns the Windows Azure Service Management API cloud app, and grants access that requires multifactor authentication. Policies aimed only at Microsoft 365 workloads do not secure Azure portal management, and Security Copilot agents are out of scope for AZ-500 control selection.