SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to enable employees to securely access on-premises applications without needing a VPN. Which Microsoft Entra feature should they implement?
⚠ Common exam trap
A common mix-up: candidates confuse Application Proxy with a VPN or assume that B2B Collaboration is needed for remote access, but the key differentiator is that Application Proxy is specifically designed for secure, VPN-less access to on-premises web apps through a reverse proxy architecture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Application Proxy
Microsoft Entra Application Proxy provides secure remote access to on-premises web applications by acting as a reverse proxy. It eliminates the need for a VPN by routing user traffic through the Entra ID service, which authenticates the user and then establishes a secure outbound connection to the on-premises application connector. This allows employees to access internal apps from anywhere using the same credentials and conditional access policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection
Why it's wrong here
Azure AD Identity Protection is a feature that helps organizations detect, investigate, and remediate identity-based risks, such as compromised credentials or suspicious sign-ins. While crucial for overall security, its primary function is not to facilitate access to on-premises applications but rather to protect the identities themselves from compromise. It works by monitoring user and sign-in behavior to identify potential threats and can then enforce automated responses like multi-factor authentication or password resets.
- ✗
B2B Collaboration
Why it's wrong here
Azure AD B2B Collaboration is specifically designed to enable secure sharing of applications and resources with external users, partners, or vendors, allowing them to use their own identities. This feature facilitates guest access by inviting external users into an organization's Azure AD tenant. However, the question specifies 'employees' accessing on-premises applications, making B2B Collaboration unsuitable as it targets external, not internal, user access scenarios.
- ✓
Application Proxy
Why this is correct
Azure AD Application Proxy provides secure remote access to on-premises web applications for internal users without requiring a VPN or opening inbound firewall ports. It acts as a reverse proxy, publishing internal applications through Azure AD, allowing employees to authenticate with their Azure AD credentials. This solution enables seamless and secure access to corporate resources from any location, making it the ideal choice for the scenario described.
- ✗
Privileged Identity Management
Why it's wrong here
Azure AD Privileged Identity Management (PIM) is a service that enables organizations to manage, control, and monitor access to important resources. It focuses on providing just-in-time and just-enough access to privileged roles, reducing the risk of excessive or unnecessary permissions. While vital for governing high-privilege accounts, PIM does not provide the underlying mechanism for general employee access to standard on-premises applications.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.