SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and a third-party SaaS application. They want to prevent users from downloading sensitive documents from the SaaS app when accessing from unmanaged personal devices, while still allowing read-only access. Which Conditional Access control should they apply to achieve this?
⚠ Common exam trap
Candidates often confuse identity-based controls (like MFA or device compliance) with app-level data protection controls, not realizing that only MDCA session policies can enforce granular actions like 'block download' while still allowing read-only access within the app itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use app control with Microsoft Defender for Cloud Apps session policy
Microsoft Defender for Cloud Apps (MDCA) session policies enable granular control over user actions within a SaaS app, such as blocking downloads while allowing read-only access. This is achieved through reverse proxy architecture that intercepts and enforces policies on HTTP/HTTPS traffic in real time, regardless of device compliance or identity provider status. Conditional Access with MDCA session control is the only option that provides app-level data protection without requiring device management or blocking access entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require multifactor authentication (MFA)
Why it's wrong here
Requiring multifactor authentication (MFA) enhances the security of the initial sign-in process by verifying a user's identity through multiple factors. However, MFA is an authentication control, not an authorization or session control. It does not provide the capability to restrict specific actions, like blocking file downloads, once a user has successfully authenticated and established a session with the third-party SaaS application.
- ✗
Require compliant device (Intune compliance policy)
Why it's wrong here
Requiring a compliant device, enforced through Microsoft Intune compliance policies and Conditional Access, ensures that only devices meeting specific security standards can access resources. While this can block access from unmanaged or unhealthy devices, it operates at the access grant level. It does not provide the granular, real-time session control needed to allow a user to view data within a third-party SaaS application but specifically prevent them from downloading files during that same session, regardless of the device's compliance status.
- ✓
Use app control with Microsoft Defender for Cloud Apps session policy
Why this is correct
Microsoft Defender for Cloud Apps (MDCAS) acts as a Cloud Access Security Broker (CASB), providing real-time session control over cloud applications. By implementing an MDCAS session policy with app control, traffic between the user and the third-party SaaS application is proxied, allowing for granular actions such as blocking file downloads while simultaneously permitting read-only access. This capability precisely addresses the requirement to allow users to view content but prevent data exfiltration through downloads, often based on contextual factors like device state or user group.
- ✗
Block access
Why it's wrong here
Blocking access, typically configured through a Microsoft Entra Conditional Access policy, is an all-or-nothing control that completely prevents a user from signing into or accessing the specified third-party SaaS application. This approach is too restrictive for the stated requirement, which is to allow users read-only access to the application's content while specifically preventing them from downloading files. Blocking access would prevent even the permitted read-only functionality.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Data protection
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.