-
Hi Abirami,
Thank you for flagging this; we appreciate the diligence. We’ve checked both points against Microsoft’s current documentation and wanted to share our findings.
On the role: the Security Administrator role can create and manage Conditional Access policies. Microsoft lists it alongside Conditional Access Administrator and Global Administrator for this exact task, so Apolinario creating the policy is valid.
On the exclusion: when a Conditional Access policy is deployed from a built-in template, the currently signed-in user (the creator) is excluded by default, as documented by Microsoft. That is why Apolinario is not prompted while Jose, Juan, and Emilio are.
You’re right that this exclusion is a removable default rather than a fixed rule; if an admin removed it, all four would be prompted. But since the question describes a standard template deployment, the default applies, and the answer stands: Jose, Juan, and Emilio only.
References:
– Require MFA for Azure management: https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-old-require-mfa-azure-mgmt
– Default exclusion of the current user: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups
– Microsoft Entra built-in roles: https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference
Thank you again for taking the time to review this.
Best,
Irene Bonso
