SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. They want to enforce that users accessing the payroll application from outside the corporate network must use multifactor authentication and must access the app only from devices that are marked as compliant by Intune. Which Conditional Access component should they use to combine these requirements?
⚠ Common exam trap
A common mix-up: candidates confuse 'Conditions' (the 'when' and 'where' of the policy) with 'Grant controls' (the 'what must happen' to gain access), leading them to incorrectly select Conditions as the component that combines the requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant controls
B is correct because Grant controls in a Conditional Access policy allow administrators to specify the access requirements that must be satisfied before a user can access a resource. In this scenario, the requirement to enforce both multifactor authentication and device compliance (from Intune) is achieved by configuring the Grant control to 'Require multifactor authentication' and 'Require device to be marked as compliant', combined with the 'Require all the selected controls' option. This ensures that both conditions must be met simultaneously for access to the payroll application from outside the corporate network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditions
Why it's wrong here
Conditions in a Microsoft Entra Conditional Access policy define the 'if' part of the policy, specifying the attributes or circumstances that must be true for the policy to be applied. These include factors like user or group membership, cloud apps being accessed, device platforms, network locations, or sign-in risk levels. They determine *when* a policy is triggered, not the specific actions or requirements that must be met to gain access.
- ✓
Grant controls
Why this is correct
Grant controls are the 'then' part of a Microsoft Entra Conditional Access policy that dictate what must be satisfied *before* access to a cloud application is granted. These controls allow administrators to enforce specific requirements such as requiring multi-factor authentication (MFA), a device marked as compliant, or a hybrid Azure AD joined device. They directly enforce the desired authentication and device posture necessary for access.
- ✗
Sign-in risk policy
Why it's wrong here
A sign-in risk policy is a specific type of Conditional Access policy *condition* within Microsoft Entra ID Protection, designed to detect and respond to potential compromises during the sign-in process. While it can trigger actions like blocking access or requiring a password change based on detected risk levels, it identifies *risk* as a condition for policy application, rather than being a control that directly enforces MFA or device compliance as a grant requirement.
- ✗
Session controls
Why it's wrong here
Session controls are applied *after* a user has successfully authenticated and satisfied any grant controls, governing specific actions or behaviors *during* an active session within a cloud application. These controls manage ongoing access by enforcing restrictions like blocking downloads, requiring reauthentication for specific actions, or setting a maximum session lifetime. They manage in-app behavior rather than initial authentication or device posture requirements.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.