Question
You have a Microsoft 365 E5 subscription that contains a user named User1 and a web app named App1.
App1 must only accept modern authentication requests.
You plan to create a Conditional Access policy named CAPolicy1 that will have the following settings:
- Assignments
- Users or workload identities: User1
- Cloud apps or actions: App1
- Access controls
- Grant: Block access
You need to block only legacy authentication requests to App1.
Which condition should you add to CAPolicy1?
- A. Filter for devices
- B. Device platforms
- C. User risk
- D. Sign-in risk
- E. Client apps Correct
Explanation
The Client apps condition lets a Conditional Access policy target legacy authentication clients (Exchange ActiveSync clients and other clients) separately from browsers and modern authentication clients. Combined with Block access, it blocks only legacy authentication. Device filters, device platforms and risk conditions do not distinguish legacy from modern authentication.
