Enforcing MFA for Remote Workers Using Named Locations

SC-200 By islever Editorial Last updated

Configure automation for Microsoft Defender XDR and Microsoft Sentinel Respond to alerts and incidents in Microsoft Defender for Endpoint

Short answer

C Include a named location to define the Istanbul office IP range as trusted, thereby excluding it from the Conditional Access policy and enforcing MFA for all other remote sign-ins.

Question

Your company has a single office in Istanbul and a Microsoft 365 subscription.
The company plans to use conditional access policies to enforce multi-factor authentication (MFA).
You need to enforce MFA for all users who work remotely.
What should you include in the solution?
  1. a fraud alert
  2. a user risk policy
  3. a named location Correct Answer
  4. a sign-in user policy

Key Takeaways

Named Locations allow you to trust specific IP ranges or countries, enabling conditional access policies to apply MFA universally except for the excluded trusted location.

Learn how to use Named Locations in Microsoft Entra ID Conditional Access to exempt trusted office IPs and enforce MFA for all remote users effectively.

Common mistake: Choosing a user risk policy is common, but it responds to identity threats rather than physical location, failing to meet the requirement of distinguishing remote vs. office workers based on network origin.

Expert Analysis

The core of this question hinges on how Conditional Access (CA) policies evaluate the origin of a sign-in to determine if MFA is required. The goal is to enforce MFA for 'all users who work remotely' while presumably allowing access without MFA for those in the Istanbul office.

A named location (Option C) allows administrators to define specific IP address ranges or geographic locations as 'trusted.' By creating a named location for the Istanbul office's IP range and excluding it from the CA policy, the policy applies to all other locations—effectively capturing all remote workers. This is the standard architectural pattern for location-based MFA enforcement in Microsoft Entra ID (formerly Azure AD). Comments correctly identify that only a named location can distinguish between the trusted office environment and untrusted remote environments based on network origin.

Other options fail because they do not address the 'remote' constraint directly via location logic. A fraud alert (Option A) triggers responses to high-risk signals but does not inherently block or require MFA based solely on geography without being part of a risk policy. A user risk policy (Option B) reacts to identity compromise risks detected by Identity Protection, not physical location. A sign-in user policy (Option D) is not a valid Conditional Access condition type; conditions are typically defined by User, Group, Cloud App, or Location.

The most attractive wrong approach might be to think about global MFA settings, but the question specifies enforcing MFA specifically for remote workers, implying an exemption for the office. Only Named Locations provide the mechanism to exclude the trusted office IP, thereby forcing MFA for everyone else.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked to enforce security controls based on location, always look for 'Named Locations' as the configuration element. Use exclusions for trusted internal networks (like office IPs) to ensure policies apply broadly to untrusted remote sources. Avoid confusing location conditions with risk-based conditions, which rely on identity protection signals rather than network data.

Frequently Asked Questions

Can I use IP addresses instead of country names in Named Locations?

Yes, Named Locations support both IPv4/IPv6 address ranges and country codes. For a single office, defining the specific IP range is often more precise than using the country.

What happens if a remote worker uses a VPN to spoof the office IP?

If the VPN terminates within the trusted IP range, the Named Location will still consider it trusted. To prevent this, you should combine Named Locations with other conditions like device compliance or block known VPN services.

More SC-200 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. Startkabels 👍 23
    Named location so you can enforce MFA except for the named location, thus forcing it for everyone who works remotely
  2. Efficia 👍 12 Answered C
    Named locations can be defined by IPv4/IPv6 address ranges or by countries. https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition#named-locations
  3. Sango 👍 6
    The key here is "all users who work remotely." Only a named location can be used to define a CA rule to allow MFA for everyone except a trusted location like the office's internal IP ranges.
  4. casti 👍 4 Answered C
    Correct
  5. xbonex99 👍 3
    C with New reference https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa
Show 6 more comments
  1. Eltooth 👍 3
    Correct - named location.
  2. Tx4free 👍 3 Answered C
    Best choice
  3. BenLam 👍 1 Answered C
    Though if MFA is to be enforced for all, it will not need a separate CA for remote workers.
  4. smanzana 👍 1
    Named location
  5. chepeerick 👍 1 Answered C
    Correct, the C
  6. Nikki0222 👍 1
    C is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Least-privilege roles for Microsoft 365 Defender action approvals

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide