The finance department wants to block sign-ins to a municipal finance app when the attempt comes from unexpected countries. Which Microsoft Entra capability is designed for that kind of policy-based control?
Select an answer to reveal the explanation.
Short Explanation
Conditional Access is the "if this, then that" gate for sign-ins—location, user, app, device, and more. Blocking finance app access from odd countries is exactly that kind of signal-based policy. Storage tiers and pricing tools do not make those decisions.
Full Explanation
Conditional Access in Microsoft Entra ID evaluates identity and session signals—such as user or group, application, device state, risk, and location—and then allows, blocks, or challenges access (for example by requiring MFA). When finance wants to block municipal finance-app sign-ins from unexpected countries, a location-based Conditional Access policy is the purpose-built control: it ties the sign-in decision to geographic or named-location signals rather than hoping a storage or compute feature will intervene.
Azure Blob archive tier changes how infrequently accessed data is stored and retrieved; it does not evaluate sign-in location or enforce identity policy. Availability Sets spread virtual machines across fault and update domains for VM resiliency inside a region; they do not make access decisions for applications. The Azure Pricing Calculator estimates cost and has no enforcement role in authentication or authorization.
Exam caveat: Conditional Access is identity-driven policy, not a substitute for network security groups or physical firewalls—location is one of several signals, not a packet filter.
Operational check: define trusted named locations for municipal finance networks, create a Conditional Access policy targeting the finance app that blocks or challenges sign-ins from untrusted countries, and test with a controlled non-trusted location simulation before enabling report-only to on for production users.