SC-900 Describe the capabilities of Microsoft Entra Practice Question
A user is unable to access a cloud app and receives a message that their sign-in was blocked by a Conditional Access policy. The admin wants to allow the user to self-remediate by meeting policy requirements. What should the admin enable?
⚠ Common exam trap
Watch out — candidates often confuse 'Conditional Access policy feedback' with other self-service features like SSPR or MFA registration, but the question specifically asks for the mechanism that provides users with actionable guidance on why they were blocked and how to meet the policy requirements, which is unique to policy feedback.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy feedback
Enabling Conditional Access policy feedback allows users to receive guidance on why their sign-in was blocked and how to meet the policy requirements, such as using a compliant device or accessing from a trusted location. This feature provides actionable messages that enable self-remediation without admin intervention, directly addressing the scenario where the user needs to unblock themselves by satisfying the policy conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Self-Service Password Reset
Why it's wrong here
Self-Service Password Reset (SSPR) allows users to reset their forgotten passwords without requiring administrator intervention. While essential for regaining access due to forgotten credentials, SSPR does not provide feedback to a user regarding why their access to a cloud application was blocked by an active policy, nor does it offer guidance on how to remediate a policy-based access restriction. It addresses credential issues, not policy compliance failures.
- ✗
Multifactor Authentication registration
Why it's wrong here
Multifactor Authentication (MFA) registration is the process where users set up and enroll additional verification methods, such as a phone or authenticator app, to strengthen their sign-in security. Although MFA is frequently a requirement enforced by access policies, the registration process itself does not provide specific, user-facing feedback about *why* a cloud app access attempt was blocked by a policy, nor does it offer remediation steps beyond the act of enabling MFA if that was the sole missing requirement.
- ✗
Identity Protection risk policies
Why it's wrong here
Azure AD Identity Protection risk policies are designed to detect potential vulnerabilities affecting an organization's identities, such as compromised credentials or suspicious sign-in behaviors. These policies can automatically block access or require MFA based on detected risk levels. However, their primary function is risk detection and automated response, not to provide explicit, user-friendly feedback detailing *which* specific policy condition was violated or how to directly remediate the policy requirement that led to the access block.
- ✓
Conditional Access policy feedback
Why this is correct
Conditional Access policies evaluate various signals, including user, device, location, application, and real-time risk, to make granular access decisions. When a user is blocked from accessing a cloud application due to a Conditional Access policy, the system is designed to provide direct, actionable feedback. This feedback explicitly informs the user *why* access was denied (e.g., 'Your device is not compliant') and often includes clear steps or links to remediate the issue, enabling them to meet the policy requirements and gain access.
Go deeper
Related to this question
Learn chapter
Conditional Access Policies
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.