SC-900 Describe the capabilities of Microsoft Entra Practice Question
A multinational company uses Microsoft Entra ID. They want to ensure that users from a specific country only access a sensitive application from compliant devices. Additionally, they want to block access if the sign-in risk is medium or high. Which combination of policies should they create?
⚠ Common exam trap
Watch out — candidates often think they need separate policies for each condition (location, device compliance, risk), but Microsoft Entra ID allows combining all three conditions into a single Conditional Access policy, which is more efficient and aligns with the scenario's requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Conditional Access policy with conditions for location, device compliance, and sign-in risk
A single Conditional Access policy can combine multiple conditions—such as location (country), device compliance (via integration with Intune), and sign-in risk—to enforce granular access controls. This allows the company to require compliant devices and block access when sign-in risk is medium or high, all within one policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Conditional Access session policy to enforce sign-in frequency
Why it's wrong here
A Conditional Access session policy to enforce sign-in frequency primarily dictates how often users must reauthenticate during a session, rather than evaluating the inherent risk of the initial sign-in attempt itself. While it enhances security by reducing session longevity, it does not integrate with Microsoft Entra ID Protection to detect or block sign-ins based on real-time risk signals like unusual location or impossible travel, making it insufficient for blocking risky sign-ins.
- ✗
A device compliance policy in Microsoft Intune
Why it's wrong here
A device compliance policy in Microsoft Intune ensures that a device meets predefined security standards, such as having an updated operating system or enabled encryption. However, this policy solely assesses the device's security posture and does not analyze the contextual risk of the sign-in attempt itself, such as unusual user behavior or suspicious IP addresses. Therefore, it cannot independently block a sign-in specifically because it is deemed 'risky' by Microsoft Entra ID Protection.
- ✗
A Conditional Access policy requiring MFA from that country
Why it's wrong here
A Conditional Access policy requiring multi-factor authentication (MFA) significantly strengthens authentication by adding a second verification factor. While crucial for security, MFA acts as an access control applied *after* the initial authentication attempt, not as a condition that assesses the *risk level* of the sign-in itself. It does not leverage Microsoft Entra ID Protection's real-time risk detection capabilities to proactively block sign-ins identified as high-risk, even if the user could potentially complete MFA.
- ✓
A Conditional Access policy with conditions for location, device compliance, and sign-in risk
Why this is correct
This Conditional Access policy effectively combines multiple critical signals to provide robust, risk-adaptive access control. By including conditions for location, device compliance, and sign-in risk (from Microsoft Entra ID Protection), it allows the system to evaluate the user's context comprehensively. This enables granular decisions, such as blocking access or requiring stronger authentication, specifically when a sign-in attempt is identified as risky based on these combined factors, directly addressing the company's security requirements.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.