SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and Intune for device management. They want to ensure that only devices marked as compliant (e.g., updated, encrypted) can access the corporate HR portal. Which Conditional Access assignment condition should the administrator configure?
⚠ Common exam trap
Test-takers frequently confuse 'Device state' with 'Sign-in risk' or 'Client apps', thinking device compliance is tied to user risk or application type, but Microsoft specifically separates device health from user risk and app context in Conditional Access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device state
The 'Device state' condition in Conditional Access allows administrators to require that only devices marked as compliant (via Intune compliance policies) can access resources. By configuring this condition, the HR portal will block access from non-compliant devices, enforcing security requirements like encryption and updates before granting access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Locations
Why it's wrong here
The Locations condition in Conditional Access policies evaluates the network origin from which a user is attempting to sign in. It can be configured to include or exclude specific IP ranges, countries, or named locations, such as trusted corporate networks or specific geographic regions. While this condition is highly effective for restricting access based on network presence, it does not assess or enforce any aspect of the device's health, configuration, or compliance status as managed by Microsoft Intune.
- ✓
Device state
Why this is correct
Device state condition can be set to require a device to be compliant (as defined in Intune) or hybrid Microsoft Entra ID joined. This is the correct condition to enforce access based on device compliance.
- ✗
Client apps
Why it's wrong here
The Client apps condition allows administrators to target Conditional Access policies based on the specific type of application used to access cloud resources. This includes modern authentication clients like web browsers, mobile and desktop applications, and even legacy authentication protocols. While useful for differentiating access requirements for various client types, this condition has no inherent mechanism to evaluate whether the device itself meets organizational compliance standards defined within Microsoft Intune.
- ✗
Sign-in risk
Why it's wrong here
Sign-in risk is a condition derived from Microsoft Entra ID Protection, which analyzes various signals (e.g., unfamiliar locations, impossible travel, infected devices) to determine the probability that a sign-in attempt is not legitimate. While crucial for protecting against compromised credentials and suspicious user behavior, this condition focuses solely on the user's sign-in event and its perceived risk. It does not assess the device's configuration, patch level, or compliance against specific device policies managed by Intune.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.