A global enterprise wants to enforce Multi-Factor Authentication for all users accessing Azure AI Studio. The policy must exclude break-glass emergency accounts. The company uses Microsoft Entra ID. Which Conditional Access policy configuration is correct?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because the policy should target all users, scoped to the Azure AI Studio application, require MFA as the grant control, and explicitly exclude the break-glass accounts (or a dedicated break-glass group) so those accounts remain accessible during lockout scenarios. B is wrong because targeting all cloud apps is too broad—the question specifically requires scoping to Azure AI Studio.
Full explanation below image
Full Explanation
A is correct because the policy should target all users, scoped to the Azure AI Studio application, require MFA as the grant control, and explicitly exclude the break-glass accounts (or a dedicated break-glass group) so those accounts remain accessible during lockout scenarios. B is wrong because targeting all cloud apps is too broad—the question specifically requires scoping to Azure AI Studio. C is wrong because requiring a compliant device is a different access control and may not be required; the question asks about MFA enforcement. D is wrong because limiting the policy to an AI-Users group means other users without the group assignment could still access Azure AI Studio without MFA.