A security engineer needs to configure Microsoft Entra ID to prevent AI automation service accounts from being used interactively (by humans logging in with the service account credentials). Which Microsoft Entra ID feature directly blocks interactive sign-in for service accounts?
Select an answer to reveal the explanation.
Short Explanation
You want to put service accounts into groups and use Conditional Access to require compliant devices. Since service accounts can't register or meet device compliance, interactive human sign-ins fail while normal service API calls still work.
Full Explanation
The correct approach is to assign the service accounts to a group and create a Conditional Access policy that blocks interactive sign-in by using the grant control 'Require compliant device.' Because service accounts, as workload identities, cannot register devices or meet device compliance requirements, this effectively blocks all interactive sign-in attempts by humans using the service account credentials while allowing the legitimate non-interactive or service API calls. The option that disables the service account's 'Account enabled' property when not in use is incorrect because disabling the account prevents all usage, including legitimate service use. The option that configures a Conditional Access policy blocking all client apps except 'Non-interactive clients' is incorrect because Conditional Access does not have a 'Non-interactive clients' filter that blocks only human interactive access while allowing service API calls; the mechanism works through device compliance or other controls. The option that sets the service account's sign-in property to a 'Service account' type is incorrect because there is no 'Service account' type property in Microsoft Entra ID that automatically disables interactive authentication; workload identities, such as service principals and managed identities, are the proper non-interactive identity type.