A security administrator needs to create a Conditional Access policy that requires a higher authentication assurance (step-up authentication) only when users attempt to perform model deployment operations in Azure AI Foundry—not for regular read access. Which Conditional Access feature implements this step-up authentication for a specific operation?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need Conditional Access authentication contexts because they let Azure AI Foundry trigger step-up authentication only for the model deployment operation. When that context is invoked, your policy can require phishing-resistant MFA, while normal read access stays untouched.
Full Explanation
The Conditional Access authentication context assigned to the model deployment operation, with a policy requiring phishing-resistant MFA when the context is triggered, is correct because Conditional Access authentication contexts allow applications to trigger step-up authentication for specific sensitive operations within the app. The Azure AI Foundry application can invoke an authentication context during the model deployment workflow, which triggers a Conditional Access policy requiring phishing-resistant MFA for that context. Users doing read-only operations do not trigger the context and face no step-up challenge. This provides granular, operation-level authentication control. The compliant device requirement for the Azure AI Foundry app is wrong because it applies to all access to the Azure AI Foundry app, not just specific operations—it cannot be scoped to the model deployment action. The sign-in risk policy requiring MFA at medium risk is wrong because sign-in risk policies are risk-based and reactive; they require MFA when a risk is detected, not proactively for specific operations. The named location restriction for Azure AI Foundry access is wrong because it blocks access by network location, not by operation type within the app.