SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and Intune to manage devices. They want to enforce a policy that allows access to financial data from SharePoint Online only when the user's device is compliant (e.g., encrypted, patched) AND the user authenticates from a trusted IP address range. Additionally, if the sign-in risk is assessed as medium or high by Identity Protection, the user must also perform multifactor authentication (MFA). Which Conditional Access components should the administrator configure?
⚠ Common exam trap
A common mix-up: candidates confuse session controls with grant controls, leading candidates to incorrectly select Option B, which misassigns device compliance as a session control instead of a grant control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure conditions for sign-in risk and locations, and use Grant controls to require MFA and device compliance.
Conditional Access in Microsoft Entra ID allows combining multiple conditions (sign-in risk, locations) with grant controls (require MFA, require device compliance) to enforce the described policy. The administrator configures conditions for sign-in risk (medium/high) and locations (trusted IP range), then uses Grant controls to require MFA and device compliance, ensuring access is allowed only when all requirements are met.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure conditions for sign-in risk and locations, and use Grant controls to require MFA and device compliance.
Why this is correct
This correctly identifies that conditions (sign-in risk and locations) are used to define when the policy applies, and Grant controls enforce the requirements. The Grant control 'Require all the selected controls' can combine device compliance and MFA.
- ✗
Configure a session control to require device compliance and an assignment for sign-in risk to trigger MFA.
Why it's wrong here
Session controls in Microsoft Entra Conditional Access are designed to monitor and restrict user actions *after* access to a cloud application has been granted, such as blocking downloads or requiring reauthentication within a session. They do not determine initial access requirements like device compliance or multi-factor authentication (MFA). Device compliance and MFA are enforced as *Grant controls*, which are evaluated *before* access is permitted.
- ✗
Use Microsoft Entra ID Protection to automatically enforce MFA and device compliance for all users regardless of location.
Why it's wrong here
Microsoft Entra ID Protection primarily functions as a risk detection and reporting service, identifying potential vulnerabilities and suspicious activities related to user identities. While it can provide 'Sign-in risk' as a condition to Conditional Access policies, it does not directly enforce access controls such as requiring MFA or device compliance. The actual enforcement of these requirements is handled by Conditional Access policies, which consume the risk signals from Identity Protection.
- ✗
Configure a compliance policy in Intune and link it directly to SharePoint Online to block non-compliant devices.
Why it's wrong here
Intune compliance policies are crucial for defining the security posture and health requirements for devices within an organization. However, these policies alone do not possess the capability to directly block or grant access to cloud applications like SharePoint Online. To enforce access decisions based on a device's compliance status, a Microsoft Entra Conditional Access policy is required, which evaluates the compliance state reported by Intune as a condition for access.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Network Access Control
Network Access Control is a security solution that enforces policies to control which devices and users can connect to a network, ensuring only authorized and compliant endpoints gain access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.