SC-900 Describe the capabilities of Microsoft Entra Practice Question
This SC-900 practice question tests your understanding of describe the capabilities of microsoft entra. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Entra ID and Intune for device management. They want to ensure that only devices marked as compliant (e.g., updated, encrypted) can access the corporate HR portal. Which Conditional Access assignment condition should the administrator configure?
Why wrong: Locations condition is based on IP addresses or geographic regions, not device compliance.
B
Device state
Device state condition can be set to require a device to be compliant (as defined in Intune) or hybrid Microsoft Entra ID joined. This is the correct condition to enforce access based on device compliance.
C
Client apps
Why wrong: Client apps condition filters by the type of application (e.g., browser, mobile app, legacy authentication), not device compliance.
D
Sign-in risk
Why wrong: Sign-in risk is part of Identity Protection and assesses the likelihood that the sign-in is unauthorized, not device compliance.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Device state
The 'Device state' condition in Conditional Access allows administrators to require that only devices marked as compliant (via Intune compliance policies) can access resources. By configuring this condition, the HR portal will block access from non-compliant devices, enforcing security requirements like encryption and updates before granting access.
Key principle: Device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Locations
Why it's wrong here
Locations condition is based on IP addresses or geographic regions, not device compliance.
✓
Device state
Why this is correct
Device state condition can be set to require a device to be compliant (as defined in Intune) or hybrid Microsoft Entra ID joined. This is the correct condition to enforce access based on device compliance.
Related concept
Device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined.
✗
Client apps
Why it's wrong here
Client apps condition filters by the type of application (e.g., browser, mobile app, legacy authentication), not device compliance.
✗
Sign-in risk
Why it's wrong here
Sign-in risk is part of Identity Protection and assesses the likelihood that the sign-in is unauthorized, not device compliance.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse 'Device state' with 'Sign-in risk' or 'Client apps', thinking device compliance is tied to user risk or application type, but Microsoft specifically separates device health from user risk and app context in Conditional Access.
Detailed technical explanation
How to think about this question
Device compliance is determined by Intune compliance policies that check conditions like BitLocker encryption, OS version, and antivirus status. The 'Device state' condition in Conditional Access evaluates the 'compliant' attribute of the device object in Microsoft Entra ID, which is updated by Intune via the MDM integration. This ensures that only devices with a compliant status token are granted access, even if the user is authorized.
KKey Concepts to Remember
Device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined.
Device compliance policies are defined and managed within Microsoft Intune.
Conditional Access evaluates device state at the time of access request.
Non-compliant devices can be blocked or forced to remediate before access.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Review device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined., then practise related SC-900 questions on the same topic to reinforce the concept.
Describe the capabilities of Microsoft Entra — This question tests Describe the capabilities of Microsoft Entra — Device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined..
What is the correct answer to this question?
The correct answer is: Device state — The 'Device state' condition in Conditional Access allows administrators to require that only devices marked as compliant (via Intune compliance policies) can access resources. By configuring this condition, the HR portal will block access from non-compliant devices, enforcing security requirements like encryption and updates before granting access.
What should I do if I get this SC-900 question wrong?
Review device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined., then practise related SC-900 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Device state requires devices to be compliant (Intune) or Hybrid Microsoft Entra ID joined.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.