SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and wants to enforce multifactor authentication (MFA) for all users accessing a sensitive customer relationship management (CRM) application, but only when the access request originates from outside the corporate network. Which component of a Conditional Access policy should the administrator configure to specify this location-based requirement?
⚠ Common exam trap
It's easy for candidates to confuse 'Assignments' (who/what) with 'Conditions' (when/where), mistakenly selecting Assignments because they think location is part of the user or app assignment, whereas Conditions specifically handle environmental factors like location, device state, and risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditions
The 'Conditions' section of a Conditional Access policy allows administrators to define the circumstances under which the policy is applied, including the location from which an access request originates. By configuring a location condition, you can specify that MFA is enforced only when users access the CRM application from outside the corporate network, using named locations or IP ranges. This is the correct component to enforce the location-based requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assignments
Why it's wrong here
Assignments specify who (users, groups, roles, workload identities) and what (cloud apps or actions) a Conditional Access policy will target. They are the initial scope definers, determining which sign-in attempts are evaluated by the policy, but they do not specify the contextual details like network location. Therefore, assignments cannot enforce access based on the physical or network location from which a request originates.
- ✓
Conditions
Why this is correct
Conditions are the "if" part of a Conditional Access policy, evaluating specific attributes of a sign-in attempt to determine if the policy applies. This includes critical contextual factors such as the user's sign-in risk level, the device platform being used, the client application, and crucially, the network location from which the access request originates. The location condition specifically allows administrators to define trusted or untrusted IP ranges, enabling enforcement based on geographic or network-specific access points.
- ✗
Grant controls
Why it's wrong here
Grant controls are the "then" part of a Conditional Access policy, dictating the access requirements that must be satisfied after the policy's conditions have been met. These controls enforce specific actions, such as requiring multi-factor authentication (MFA), a compliant device, or a hybrid Azure AD joined device, before granting access. While essential for enforcing security posture, grant controls specify what is required for access, not where the access attempt originates.
- ✗
Session controls
Why it's wrong here
Session controls are applied after a user has successfully authenticated and met all grant control requirements, managing the user's experience within the session itself. These controls can enforce actions like restricting downloads, requiring reauthentication at a specific interval, or using a Conditional Access App Control policy to monitor and control real-time session activities. They focus on post-authentication behavior and session management, not on evaluating the initial access location.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.