SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company has Microsoft Entra ID with Conditional Access policies. Users report being prompted for MFA every time they access the company's CRM app from their corporate laptops. However, the policy is configured to require MFA only for untrusted locations. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume location is the only condition evaluated, but Conditional Access policies can combine multiple conditions, and device compliance often overrides location when devices are not trusted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The corporate laptops are not marked as compliant devices.
The most likely cause is that the corporate laptops are not marked as compliant devices. Conditional Access policies can use device compliance as a condition; if the laptops are not compliant, they may be treated as untrusted, triggering MFA even if the location is trusted. Device compliance is determined by Microsoft Intune or another MDM, and without it, the policy's location condition may not override the device state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Users are authenticating via device code flow.
Why it's wrong here
Users are authenticating via device code flow. This authentication method is specifically designed for input-constrained devices, such as smart TVs or IoT devices, that lack a full browser interface. Corporate laptops possess complete browser capabilities, rendering the device code flow unnecessary and irrelevant to a scenario involving repeated MFA prompts during standard corporate access.
- ✗
The Conditional Access policy has the 'Persistent browser session' setting enabled.
Why it's wrong here
The Conditional Access policy having the 'Persistent browser session' setting enabled would actually reduce the frequency of authentication prompts, including MFA. This setting allows users to remain signed in after closing and reopening their browser, thereby minimizing re-authentication requests rather than causing repeated MFA challenges.
- ✗
The policy is blocking legacy authentication.
Why it's wrong here
If a Conditional Access policy is blocking legacy authentication, it means that older protocols like POP3, IMAP, or SMTP are prevented from accessing Microsoft Entra ID. This action would result in access denial for clients attempting to use these legacy methods, not a continuous loop of repeated MFA prompts for modern authentication flows.
- ✓
The corporate laptops are not marked as compliant devices.
Why this is correct
If corporate laptops are not marked as compliant devices, Conditional Access policies can be configured to require device compliance as a grant control. When a device fails to meet the defined compliance standards (e.g., missing security updates, unencrypted), the Conditional Access policy will enforce re-authentication, including MFA, or even block access until the device's compliance status is remediated.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.