Free sampleImplement and Manage Identity and Accessmedium
An admin asks whether they can save a single Conditional Access policy that includes both a User risk condition set to High and a Sign-in risk condition set to Medium or High. Microsoft recommends combining sign-in risk and user risk conditions in the same Conditional Access policy. Is this statement correct?
- AYes
- BNo Correct
Always split user risk and sign-in risk into separate Conditional Access policies; never combine the two conditions in one policy. The Risk policies article carries an explicit warning: Don't combine sign-in risk and user risk conditions in the same Conditional Access policy. Create separate policies for each risk condition. The documented design pattern is one policy per risk type.
Why A is wrong: Combining the two conditions produces unpredictable enforcement, which is why the documentation flags it as something to avoid and instead requires separate policies.
Why B is correct: Correct. The Risk policies article carries an explicit warning: Don't combine sign-in risk and user risk conditions in the same Conditional Access policy.