A network engineer argues that Microsoft Entra Conditional Access is simply another hardware firewall appliance for the city datacenter. How should a fundamentals-level reply correct that view?
Select an answer to reveal the explanation.
Short Explanation
Firewalls babysit packets; Conditional Access babysits sign-ins. It lives in the identity world—who you are, where you are, what app you want—not as a box with network ports. Mixing those up is a common trap.
Full Explanation
Microsoft Entra Conditional Access is an identity-driven access policy engine. It sits in the authentication and authorization path for users and apps: after signals are evaluated, it can allow access, block access, or require controls such as MFA or compliant devices. It is not a hardware firewall appliance you rack in the city datacenter, and it does not replace network security groups, Azure Firewall, or on-premises packet filters. A fundamentals-level correction to the network engineer is therefore conceptual: Conditional Access governs who may access which apps under which conditions, not which TCP ports traverse a virtual network.
It does not replace every NSG and is not physical hardware to install. It is not limited to filtering TCP ports on Azure virtual networks, nor is it an Azure Storage redundancy feature. Those distractors mix networking and data-durability ideas with an identity policy service.
Exam caveat: AZ-900 expects you to place Conditional Access under Microsoft Entra identity, adjacent to MFA and SSO discussions—not under networking appliances or storage tiers.
Operational check: open Microsoft Entra Conditional Access in the portal, review an existing policy’s assignments (users/apps) and conditions (location, device, risk), and confirm the grant controls—without looking for a datacenter firewall SKU or storage redundancy setting.