SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID (Azure AD). The IT team has created a security group named 'SalesTeam' that contains all sales department users. They want to ensure that only members of this group can access the company's CRM application, which is registered as an enterprise application in Entra ID. What should the IT team configure?
⚠ Common exam trap
Many candidates confuse Conditional Access (which controls conditions and grants during authentication) with user/group assignment (which controls the fundamental ability to authenticate to the application), leading candidates to select A when C is the direct and correct configuration for restricting access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enterprise application user and group assignment
Enterprise applications in Microsoft Entra ID can be configured to require user or group assignment, which restricts access to only assigned users or groups. By assigning the 'SalesTeam' security group to the CRM enterprise application, the IT team ensures that only members of that group can authenticate and access the application. This is the standard method for controlling access to gallery or custom enterprise applications in Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Conditional Access policy that requires group membership
Why it's wrong here
A Conditional Access policy is designed to enforce additional security requirements or restrictions after a user has been granted initial access to an application. While such a policy can indeed require group membership as a condition, its purpose is to evaluate the context of an access attempt (e.g., device state, location, sign-in risk) and apply controls like MFA or blocking access, rather than being the primary mechanism for initially granting access to the application. It acts as a secondary layer of control, not the initial authorization.
When this WOULD be correct
A Conditional Access policy requiring group membership would be correct if the question asked for a way to enforce additional security controls, such as requiring multi-factor authentication or blocking access from untrusted locations, specifically for members of the SalesTeam group accessing the CRM app.
- ✗
Self-service group management settings
Why it's wrong here
Self-service group management allows designated users to create, join, or manage the membership of groups without requiring IT administrator intervention. This feature is focused on empowering end-users with group lifecycle management capabilities, such as creating distribution lists or security groups for collaboration. However, these settings do not directly control or grant access to specific enterprise applications; they manage the groups themselves, which can then be used in other access control mechanisms.
When this WOULD be correct
A company wants to allow sales managers to create and manage their own security groups without IT intervention. The IT team would configure self-service group management settings to delegate group creation and membership management to non-administrators.
- ✓
Enterprise application user and group assignment
Why this is correct
This is the fundamental and most direct method to control which users or groups are authorized to access a specific enterprise application in Microsoft Entra ID. By assigning a group like 'SalesTeam' to the CRM application, you explicitly provision access for all members of that group, ensuring only authorized individuals can sign in and utilize the application. This method establishes the baseline access permissions for the application.
- ✗
Application registration settings
Why it's wrong here
Application registration in Microsoft Entra ID is primarily used to establish the identity of an application, define its permissions to access other resources (like Microsoft Graph), configure authentication protocols, and specify redirect URIs. While crucial for an application's integration and functionality within Entra ID, these settings do not directly control which specific users or groups are granted access to the application itself. They define how the app interacts with Entra ID, not who can use it.
When this WOULD be correct
A developer registers a new custom app in Entra ID and needs to configure its authentication endpoints, API permissions, or client credentials. The question would ask: 'What should the developer configure to allow the app to authenticate users?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enterprise application user and group assignmentCorrect answer▾
Why this is correct
This is the fundamental and most direct method to control which users or groups are authorized to access a specific enterprise application in Microsoft Entra ID. By assigning a group like 'SalesTeam' to the CRM application, you explicitly provision access for all members of that group, ensuring only authorized individuals can sign in and utilize the application. This method establishes the baseline access permissions for the application.
✗A Conditional Access policy that requires group membershipWrong answer — click to see why▾
Why this is wrong here
Conditional Access policies control access based on conditions like location or device state, not direct user-to-app assignment. The requirement is to restrict access to only SalesTeam members, which is achieved by assigning the group to the enterprise application, not by a Conditional Access policy.
★ When this WOULD be the correct answer
A Conditional Access policy requiring group membership would be correct if the question asked for a way to enforce additional security controls, such as requiring multi-factor authentication or blocking access from untrusted locations, specifically for members of the SalesTeam group accessing the CRM app.
Why candidates choose this
Candidates may confuse Conditional Access with direct assignment because both involve groups and access control, but Conditional Access is for conditions and policies, not for granting basic access to an application.
✗Self-service group management settingsWrong answer — click to see why▾
Why this is wrong here
Self-service group management settings allow users to create and manage their own groups, but do not control access to an enterprise application. Access to the CRM app requires explicit user/group assignment, not group management features.
★ When this WOULD be the correct answer
A company wants to allow sales managers to create and manage their own security groups without IT intervention. The IT team would configure self-service group management settings to delegate group creation and membership management to non-administrators.
Why candidates choose this
Candidates may confuse the concept of managing group membership with controlling access to applications, thinking that enabling self-service for the SalesTeam group would automatically grant access to the CRM app.
✗Application registration settingsWrong answer — click to see why▾
Why this is wrong here
Application registration settings define how an app authenticates (e.g., redirect URIs, certificates), not which users can access it. User assignment for access is configured in the enterprise application's 'Users and groups' blade.
★ When this WOULD be the correct answer
A developer registers a new custom app in Entra ID and needs to configure its authentication endpoints, API permissions, or client credentials. The question would ask: 'What should the developer configure to allow the app to authenticate users?'
Why candidates choose this
Candidates confuse the initial registration of an application with the post-registration access control, assuming that settings during registration include user assignment.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.