City staff on the municipal network may sign in with a password, but staff working from home must complete MFA. Which concept describes that signal-based enforcement?
Select an answer to reveal the explanation.
Short Explanation
Same user, different place, different bar to clear—that is Conditional Access reading a location signal. On the city network one path; off-network, require MFA. Storage redundancy and management-group hierarchy are not that switch.
Full Explanation
Conditional Access applies access controls based on conditions evaluated at sign-in time. A classic municipal pattern is to allow password-only access from trusted corporate or city network locations while requiring multifactor authentication when the same users connect from home or other untrusted locations. Network location is one of the signals Conditional Access can use; the policy then grants access, blocks it, or demands stronger proof. That signal-based enforcement is exactly the concept described when on-network staff and remote staff face different authentication strength for the same identity platform.
Geo-redundant storage copies data between regions for durability; it does not implement MFA challenges. Management groups organize subscriptions for governance and policy inheritance; they do not automatically replace passwords with phone prompts. ExpressRoute provides private connectivity into Azure and does not permanently disable MFA for remote users—connectivity and authentication strength remain separate concerns.
Exam caveat: requiring MFA from home while relaxing it on the municipal network still fits Zero Trust thinking if you treat network location as only one signal and continue to verify for sensitive apps and roles.
Operational check: mark city office egress IPs as a trusted named location, build a Conditional Access policy that requires MFA when location is not trusted for the target apps, and verify both an on-network and a home sign-in behave as designed before broad enforcement.