You have five session hosts and users who connect over the internet from Seattle and Vancouver offices. To ensure only connections from those two offices are allowed, which control should you use?

Conditional Access policies are designed to enforce organizational access controls based on various conditions, including user location. By configuring a Conditional Access policy, you can specify that connections to Azure Virtual Desktop resources are only permitted from IP ranges associated with your Seattle and Vancouver offices, effectively blocking access from other locations. RDP Shortpath optimizes RDP connectivity but does not provide access control based on location. An NSG controls network traffic to and from Azure resources at the subnet or NIC level, but it's less granular and dynamic for user-specific location-based access control across the internet compared to Conditional Access. Azure Firewall provides network-level protection and traffic filtering but is typically used for broader network segmentation and outbound filtering rather than user-specific inbound geographic access restrictions.