MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your organization has a Microsoft 365 E5 tenant with 10,000 users. You need to ensure that when a user is detected as high-risk by Microsoft Entra ID Protection, the user is automatically blocked from accessing sensitive SharePoint sites. The solution should minimize administrative overhead. What should you do?
⚠ Common exam trap
Candidates often confuse a user risk policy in Entra ID Protection (which blocks all sign-ins globally) with a Conditional Access policy (which can target specific applications like SharePoint), leading them to choose Option C instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.
A Conditional Access (CA) policy can directly target 'High risk' users (via Microsoft Entra ID Protection risk detection) and apply to SharePoint. By setting the grant control to 'Block access' or 'Use app enforced restrictions', you automatically block or restrict access to sensitive SharePoint sites without manual intervention, minimizing administrative overhead. This integrates natively with Microsoft 365 and requires no additional services or custom scripting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Conditional Access policy targeting high-risk users, apply to SharePoint, and set 'Block access' or 'Use app enforced restrictions'.
Why this is correct
Conditional Access policies natively consume Entra ID Protection risk signals. By selecting 'High risk' under User risk and assigning the SharePoint cloud app, you can enforce access controls directly: 'Block access' fully prevents access, while 'Use app enforced restrictions' applies SharePoint's built-in restricted-access user policy. This is the most straightforward, scenario-specific configuration for preventing high-risk users from reaching SharePoint.
- ✗
Create a session policy in Microsoft Defender for Cloud Apps to block high-risk users from accessing SharePoint.
Why it's wrong here
A Defender for Cloud Apps session policy gives you real-time granular control after sign-in, but it requires app onboarding and routing through Conditional Access App Control. It does not natively evaluate the Identity Protection user risk level; to react to that signal, you would need extra infrastructure to pass risk status into the session, making this a much less direct method. Additionally, targeting only SharePoint would be challenging without substantial extra setup.
- ✗
Configure a user risk policy in Microsoft Entra ID Protection to block sign-ins for high-risk users.
Why it's wrong here
An Entra ID Protection user risk policy is a tenant-wide, app-agnostic control that blocks the interactive sign-in attempt when the account's risk is high. It cannot scope to just SharePoint, and it cannot permit a session while applying SharePoint-specific restrictions. This approach would block access to all cloud apps, rather than protecting SharePoint specifically as the requirement states.
- ✗
Deploy Microsoft Sentinel and create a custom analytics rule to trigger an automated response via Logic App.
Why it's wrong here
Turning to Microsoft Sentinel would involve ingesting Identity Protection logs, writing a custom KQL analytics rule, and orchestrating a Logic App to trigger remediation. Even then, the response would likely be to disable the account or reset credentials, which is not the same as conditionally denying SharePoint access. This is a disproportionately complex solution when a native Conditional Access policy can meet the requirement in minutes.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.