Design security operations, identity, and compliance capabilities →hardMultiple Choice

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "Block all apps except Microsoft 365",
    "state": "enabled",
    "conditions": {
      "applications": {
        "includeApplications": ["All"],
        "excludeApplications": ["Office365"]
      },
      "users": {
        "includeUsers": ["All"]
      },
      "clientAppTypes": ["All"]
    },
    "grantControls": {
      "builtInControls": ["block"]
    }
  }
}

The exhibit shows a conditional access policy in Microsoft Entra ID. What will be the effect of this policy?

⚠ Common exam trap

The trap here is that candidates often overlook the 'Exclude' list and assume that selecting 'All cloud apps' with 'Block access' blocks everything, but the exclusion of Office365 means it is not blocked.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Block all applications except Office365

The exhibit shows a Conditional Access policy that includes 'All cloud apps' in the target resources and is configured with a 'Block access' grant control. The 'Exclude' list contains 'Office365', meaning the policy applies to all applications except Office365. Therefore, the effect is to block access to all applications except Office365, making option D correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allow all applications except Office365
Why it's wrong here
This option misinterprets the grant control. The exhibit shows the policy's Grant control is set to 'Block access', not 'Allow access', so the result is denial of access for all included applications. While Office 365 is excluded and therefore not subject to the policy, that does not mean the policy 'allows' anything—it simply does not apply to that excluded app. The net effect is a block on all apps except Office 365, not an allow.
✗
Block all applications including Office365
Why it's wrong here
This option incorrectly claims that Office 365 is included in the block. The exhibit places Office 365 in the 'Excluded cloud apps' list of the Conditional Access policy. Since excluded applications are skipped during policy evaluation, the Block grant control is never applied to Office 365 sessions. Consequently, the policy blocks all applications except Office 365, not including it.
✗
Allow all applications including Office365
Why it's wrong here
This option is doubly incorrect: it misreads the grant control as 'Allow' and also ignores the explicit exclusion of Office 365. The grant control is 'Block access', so every included cloud app is denied access. Additionally, Office 365 is listed as an excluded app, so it is not evaluated by this policy at all. The actual effect is that all non-excluded applications are blocked, while Office 365 is unaffected by this policy.
✓
Block all applications except Office365
Why this is correct
The policy is configured to target 'All cloud apps', excludes Office 365, and uses the 'Block access' grant control. When a user attempts to access an included application, the policy is evaluated and blocks the sign-in. Since Office 365 is in the exclusion list, the policy is skipped for that application, leaving it unblocked. Therefore, the policy blocks all applications except Office 365.

Go deeper

SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question