First Step for AVD Reauthentication in New Subscription
Short answer
B Disable Security defaults to allow the creation of a Conditional Access policy for reauthentication.
Question
Key Takeaways
This question tests the prerequisite dependency between Conditional Access and Security Defaults in new Azure tenants, trapping learners who skip straight to creating the policy.
In a new Azure subscription, Entra ID Security Defaults are enabled by default, which blocks the creation of Conditional Access policies. This page establishes that disabling Security Defaults is the mandatory first step to configure custom sign-in frequency for Azure Virtual Desktop.
Common mistake: Choosing to create a Conditional Access policy because it directly controls sign-in frequency, while ignoring that Security Defaults must be disabled first in a new tenant.
Expert Analysis
Why the Answer Is Correct
In a new Azure subscription, Entra ID Security Defaults are automatically enabled to provide baseline security. Security Defaults and Conditional Access policies are mutually exclusive; you cannot create a Conditional Access policy while Security Defaults are active. Therefore, before you can configure a six-hour sign-in frequency using Conditional Access, you must first disable Security Defaults.Why the Other Options Are Wrong
Creating a Conditional Access policy (Option A) is the mechanism to set the six-hour reauthentication interval, but it will fail if Security Defaults are still enabled. Configuring an authentication methods policy (Option C) or MFA (Option D) does not control session sign-in frequency and does not address the prerequisite blocker of Security Defaults in a new tenant.Community Comment Notes
Several community members pointed out this dependency, noting that "Security Defaults are enabled on new Azure subscriptions by default and must be disabled before Conditional Access policies can be used." Others recognized the wording trap, stating "It's a trick question... asks what should be done first" and emphasizing that disabling Security Defaults is universally required for new tenants before custom policies can be applied.Official Reference
https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
This link opens the official vendor documentation in a new tab.
Exam Strategy
Pay close attention to keywords like "new Azure subscription" which imply default configurations. Remember that Security Defaults block Conditional Access, so disabling them is always the prerequisite step in new tenants before configuring custom sign-in frequencies.
Community Votes
60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 9 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors, not of islever. The comments shown first are the most substantive of the thread — ranked by depth, community endorsement and relevance; expand the list below to read the rest.
From public community threads 9
-
barxan1 👍 5First of all we should disable security defaults, then we can create a condition access policy and only after that we can configure MFA
-
jeff1988 👍 2 Answered AA. Create a Conditional Access policy. Conditional Access policies allow you to set the sign-in frequency, which can be configured to require reauthentication every six hours. This approach ensures that users are prompted to reauthenticate at the specified interval, enhancing security.
-
ClintC03 👍 2 Answered BSecurity Defaults are enabled on new Azure subscriptions by default and must be disabled before Conditional Access policies can be used. https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
-
hwoccurrence 👍 1 Answered AConditional Access is what lets you set a custom sign‐in frequency (e.g., every six hours). Even though in a brand‐new tenant you often must disable Security Defaults first to create any custom Conditional Access policy, the exam (and Microsoft documentation) typically views “Create a Conditional Access policy” as your first major configuration step for sign‐in frequency. So while real‐world practice often includes disabling Security Defaults before advanced Conditional Access, the standard (and correct) exam answer to achieve six‐hour reauthentication is: A. Create a Conditional Access policy
-
AITANA_MANAGEMENT 👍 1 Answered BIt's a trick question, in my opinion. If you look closely, it asks what should be done first. Keep in mind that we don't know if the tenant has Entra ID P1, so we can't be sure if Conditional Access (CA) can be configured. However, what is universally true is that by default, all new tenants have Security Defaults enabled. So, the first step should be to disable Security Defaults, and the second step would be to configure Conditional Access.
Show 4 more comments
-
brucespr 👍 1 Answered BIf your tenant was created on or after October 22, 2019, security defaults might be enabled in your tenant. To protect all of our users, security defaults are being rolled out to all new tenants at creation. Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults. https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
-
lopt0909 👍 1 Answered Acreate condition access policy first and then config MFA
-
Darkphoenix126 👍 2 Answered AShould be A
-
Bonifacef 👍 1 Answered DCorrect
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AZ-140 Questions
Access 64 questions with complete answers and detailed explanations.
View Full AZ-140 Practice Test →