SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. They want to require all users accessing the external vendor portal to accept a terms of use document before they are granted access. The acceptance must be revoked after 30 days, requiring the user to accept again. Which Conditional Access component should the administrator configure?
⚠ Common exam trap
Candidates often confuse 'Session controls' (which manage sign-in frequency or app restrictions) with the ability to enforce terms of use acceptance, but only the 'Grant' control can require a terms of use document to be accepted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access controls (Grant)
The administrator needs to enforce a terms of use acceptance that expires after 30 days. In Conditional Access, the 'Access controls (Grant)' section includes the 'Require terms of use' option, which can be configured to require re-acceptance after a specified duration (e.g., 30 days). This directly meets the requirement by blocking access until the user accepts the current version of the terms of use document.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assignments
Why it's wrong here
Assignments define the scope of a Conditional Access policy, specifying which users, groups, cloud apps, or user actions the policy targets. While essential for determining who and what a policy applies to, Assignments do not dictate the specific access requirements or actions that must be enforced. They merely identify the subjects and resources for which the policy's controls will be evaluated, not the action of requiring Terms of Use.
- ✓
Access controls (Grant)
Why this is correct
Access controls, specifically the "Grant" controls within Conditional Access policies, are precisely where administrators define the requirements users must satisfy to gain access to a resource. This section allows for mandating actions like multifactor authentication, requiring a device to be marked as compliant, or, critically, demanding explicit acceptance of Terms of Use before access is permitted. It directly enforces the "allow or block" decision based on specified conditions.
- ✗
Conditions
Why it's wrong here
Conditions in Conditional Access policies evaluate the context of a sign-in attempt to determine if a policy should apply. These contextual signals include factors such as the user's sign-in risk level, the device platform being used, the network location, or the client application. While conditions are crucial for triggering a policy based on specific scenarios, they do not define the actual access requirement or control, such as prompting for Terms of Use acceptance.
- ✗
Session controls
Why it's wrong here
Session controls in Conditional Access policies manage user actions during an established session, after initial access has been granted. These controls, often integrated with Microsoft Defender for Cloud Apps, enable capabilities like restricting downloads, requiring reauthentication for sensitive actions, or enforcing app-enforced restrictions. They focus on ongoing session behavior and limitations rather than the initial gatekeeping requirement of accepting Terms of Use.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.