SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants employees to be able to access corporate applications from their personal mobile devices, but only if those devices are enrolled in mobile device management (MDM) and have a PIN code set. Which Microsoft Entra capability should the administrator use to enforce these requirements?
⚠ Common exam trap
Candidates often confuse Conditional Access with Identity Protection, thinking that risk-based policies (like requiring MFA for risky sign-ins) are the same as device compliance policies, but Identity Protection does not enforce device enrollment or PIN requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the correct Microsoft Entra capability because it allows administrators to create policies that enforce specific requirements—such as device enrollment in MDM and a PIN code—before granting access to corporate applications. By configuring a Conditional Access policy with a grant control requiring 'Require device to be marked as compliant' (which depends on MDM enrollment and PIN compliance), the administrator can block access from personal devices that do not meet these conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection focuses on detecting and remediating identity-based risks, such as sign-ins from unfamiliar locations, impossible travel, or leaked credentials. While crucial for securing user accounts, it does not provide the mechanism to define and enforce device-specific conditions, like requiring a device to be compliant or managed, as a prerequisite for accessing corporate resources. Its primary function is risk assessment and automated response related to user identity compromise.
- ✓
Conditional Access
Why this is correct
Conditional Access policies in Microsoft Entra ID are powerful "if-then" statements that define conditions under which users can access resources. It can specifically require that a device accessing corporate applications is marked as compliant by an MDM solution, such as Microsoft Intune, ensuring it meets security standards like having a PIN or being encrypted. This capability directly enforces device management requirements as a prerequisite for access, aligning perfectly with the company's goal.
- ✗
Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within an organization. It enables just-in-time (JIT) and just-enough-administration (JEA) access for privileged roles, requiring activation and often approval workflows for elevated permissions. PIM's scope is strictly focused on securing and auditing administrative roles, not on establishing general device compliance policies for all users accessing corporate applications.
- ✗
Enterprise App Registration
Why it's wrong here
Enterprise App Registration in Microsoft Entra ID is the process of creating an identity for an application, allowing it to integrate with Entra ID for authentication and authorization purposes. This enables features like single sign-on (SSO) and grants the application permissions to access user data or other resources. However, app registration itself does not define or enforce access conditions, such as requiring a compliant device, for users attempting to access that application.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Mobile device management
Mobile device management (MDM) is a security solution that allows IT administrators to enroll, configure, monitor, and enforce policies on smartphones, tablets, and other mobile devices used in an organization.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.