Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 1051–1125

For Microsoft Defender for Cloud Apps to perform Shadow IT discovery, it requires network traffic logs from an organization's firewalls and proxies. A log collector is a lightweight agent deployed on-premises, typically on a dedicated server, that securely ingests these logs, parses them, and then forwards them to Defender for Cloud Apps. This process enables the service to analyze user activity, identify sanctioned and unsanctioned cloud applications, and assess their risk.

Microsoft Entra B2B collaboration is the specific feature designed for securely sharing applications and resources with external users from other organizations. It enables partners to use their own corporate or social identities (e.g., Microsoft accounts, Google IDs) to authenticate, rather than requiring them to create new credentials in your tenant. Upon invitation, these partners are represented as guest user objects in your Microsoft Entra ID, allowing for granular access control to specified resources.

Conditional Access policies evaluate various signals, including user, device, location, application, and real-time risk, to make granular access decisions. When a user is blocked from accessing a cloud application due to a Conditional Access policy, the system is designed to provide direct, actionable feedback. This feedback explicitly informs the user *why* access was denied (e.g., 'Your device is not compliant') and often includes clear steps or links to remediate the issue, enabling them to meet the policy requirements and gain access.

This is a correct answer because "Block executable content from email client and webmail" is a specific Attack Surface Reduction (ASR) rule designed to prevent malware from being launched directly from email applications or webmail services. This rule targets common infection vectors by blocking the execution of files like .exe, .dll, or .js that originate from email clients (e.g., Outlook) or popular web browsers when accessing webmail. It helps mitigate phishing and drive-by download attacks by restricting the initial execution phase.

Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID is the direct and correct solution for allowing users to reset their own forgotten passwords without requiring administrator assistance. Once SSPR is configured and users have successfully registered their chosen authentication methods (e.g., mobile app, phone, email), they can independently verify their identity and set a new password, significantly improving user experience and reducing help desk workload.

Role inclusion in a conditional access policy targets the directory role assignment, so every user holding Global Administrator or Exchange Administrator membership is in scope. The policy evaluates role membership, not sign-in location or client app, so all such members are affected.

The Microsoft Authenticator app offers a highly effective and cost-efficient solution for passwordless sign-in across a wide range of devices, including iOS, Android, and Windows. It leverages existing smartphone hardware to provide a secure, push-notification-based or number-matching authentication method, eliminating the need for users to type a password. This approach minimizes additional hardware costs, simplifies deployment, and enhances user convenience and security by removing the weakest link in traditional authentication.

Microsoft Purview eDiscovery provides the capability to export identified search results, including emails, documents, and other content, into a portable PST (Personal Storage Table) file format. This export functionality is crucial for transferring collected evidence to legal review platforms, external counsel, or for offline analysis. The PST file preserves the original metadata and folder structure, ensuring the integrity and usability of the collected data.

Digital signatures let the recipient verify that a record's contents have not been altered in transit, because any modification invalidates the signature check against the signer's key. This directly satisfies the requirement to detect tampering, which is the integrity goal rather than confidentiality or availability.

Least privilege grants users only the access required for their tasks, limiting lateral movement if credentials are compromised. This directly implements Zero Trust's assume-breach principle by constraining each identity's permissions rather than trusting network location.

Cloud Security Posture Management continuously assesses Azure, AWS and GCP resources against security benchmarks, surfacing misconfigurations and hardening recommendations in one unified dashboard. This satisfies the multi-cloud visibility and posture-assessment requirement, unlike workload protection plans that focus on runtime threat detection per resource type.

This option is incorrect because the device *does* satisfy at least one of the specified conditions. Specifically, the device being Microsoft Entra joined fulfills the 'Domain joined' requirement as interpreted by Conditional Access. Consequently, stating that neither condition is met is a false assessment of the device's state against the policy.

Infrastructure as a Service (IaaS) is the correct choice for migrating existing on-premises workloads to Azure because it provides the most control over the underlying operating systems, applications, and data, closely mirroring an on-premises environment. In IaaS, the customer is responsible for securing the operating system, applications, network configuration, and data, while Azure manages the physical infrastructure, virtualization, and networking fabric. This model facilitates a "lift-and-shift" approach, allowing the CISO to maintain significant security responsibility and control over their familiar stack within the cloud.

The query correctly filters `SecurityAlert` records generated within the last 7 days for MFA failure anomalies. It then groups these anomalies by user and calculates the total count for each user. The subsequent `where AlertCount > 5` clause precisely isolates and presents only those users whose aggregated count of MFA failure anomalies exceeds five, directly matching the objective described in this option.

Microsoft Sentinel is a cloud-native SIEM and SOAR platform that ingests logs from firewalls, servers and cloud applications, provides built-in threat intelligence, KQL-based advanced hunting, custom analytics alerts and Logic Apps playbooks for automated response, satisfying every requirement in the scenario.

Utilizing the Copilot prompt bar within the Microsoft Defender portal is the correct and intended method for leveraging Microsoft Copilot for Security to generate KQL queries. This integrated interface allows security analysts to input natural language descriptions of their threat hunting or investigation needs. Copilot then processes these prompts, translating them into accurate KQL queries that can be immediately executed in Advanced Hunting, significantly streamlining security operations and enhancing analyst productivity.

Sensitivity labels apply encryption at classification, satisfying the 'Privileged' tagging requirement. DLP blocks unauthorised email sharing, Communication Compliance monitors Teams chats, Data Lifecycle Management enforces the seven-year retention then deletion, and eDiscovery supports legal hold searches. Together these Microsoft Purview solutions cover every stated constraint.

Microsoft Entra ID dynamic groups automatically manage membership based on defined attribute-based rules, such as a user's department or job title. When a user's attributes change, they are automatically added to or removed from the group, ensuring accurate membership. This capability is crucial for automating license assignment through group-based licensing, as licenses are then automatically provisioned or de-provisioned as users join or leave these dynamic groups.

The Regulatory Compliance dashboard in Microsoft Defender for Cloud is specifically designed to assess and report on your organization's adherence to various industry standards and regulatory benchmarks. By adding the CIS standard as a compliance initiative, Defender for Cloud automatically maps relevant security recommendations and assessments to the specific controls within that standard, providing a consolidated view of your compliance posture. This direct integration enables comprehensive tracking and reporting against the chosen benchmark.

Microsoft Defender XDR's core strength lies in its ability to automatically correlate alerts from various Defender services into unified incidents. This powerful cross-domain correlation engine requires all constituent Defender services (e.g., Defender for Endpoint, Office 365, Identity) to be onboarded within the *same* Azure Active Directory tenant. The incidents feature, which drives this correlation, is enabled by default, ensuring a holistic view of attacks and significantly reducing alert fatigue for security operations teams.

Creating the sensitivity label in the Microsoft Purview compliance portal is the foundational and indispensable first step for implementing data classification. This action involves defining the label's name, description, visual markings, and associated protection settings like encryption or access restrictions. Without this initial creation, no label exists to be published or applied, making it the absolute prerequisite for any data classification initiative using Microsoft Purview Information Protection.

Microsoft Entra federation with SaaS applications is the correct solution because it enables employees to use their existing corporate Microsoft Entra ID credentials for single sign-on (SSO) to third-party Software as a Service (SaaS) applications. This process involves configuring Microsoft Entra ID as the identity provider, allowing it to authenticate users and securely pass identity assertions (e.g., via SAML or OIDC) to the SaaS application, eliminating the need for separate usernames and passwords. This enhances user experience, improves security posture, and centralizes identity management.

Converting a mailbox to shared does not remove an eDiscovery hold, but the hold must remain associated with the case. Confirming it is still listed verifies the mailbox is still within scope, satisfying the requirement that the legal hold stays effective.

The cmdlet applies a sensitivity label to the specified document, tagging it with the organisation's classification so encryption and protection policies follow the file. It does not create, remove or list labels, only assigns one.

Impersonation protection within an anti-phishing policy is specifically engineered to identify and mitigate attacks where attackers spoof a known user's display name or email address, or a trusted domain. It analyzes various email attributes, including sender display name, sender address, and domain similarity, against configured protected users and domains to detect and act upon these highly targeted phishing attempts. This direct focus on identity spoofing makes it the correct control for preventing impersonation.

Verify explicitly requires authentication and authorisation decisions using all available signals, including identity, device health and location. It satisfies the Zero Trust principle that every access request is fully authenticated before resource access is granted.

Retention labels in Microsoft Purview are specifically designed to manage the lifecycle of data, including its eventual deletion. By creating a retention label with a 3-year retention period and a disposition action set to deletion, the organization ensures that content is preserved for the required duration and then automatically removed from its location. This mechanism is central to compliant data lifecycle management, enforcing policy across various Microsoft 365 services to meet regulatory and internal governance requirements.

Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against various regulatory frameworks. It provides pre-built assessment templates for numerous regulations (e.g., GDPR, HIPAA, ISO 27001), a quantifiable compliance score, and actionable improvement recommendations. This centralized dashboard allows for continuous monitoring, tracking progress on improvement actions, and generating reports to demonstrate adherence to complex global and industry-specific compliance requirements.

This solution provides comprehensive protection for hybrid identity environments by monitoring Active Directory and Azure Active Directory signals. It detects advanced threats, compromised identities, and malicious insider actions using behavioral analytics and machine learning. As a core component of Microsoft Defender XDR, it correlates identity-related incidents with signals from endpoints, email, and cloud apps to provide a unified view of an attack.

Conditional Access App Control proxies sessions through Defender for Cloud Apps, letting administrators monitor and block user activity within cloud apps in real time. This satisfies the requirement to control actions inside sanctioned apps, which API-based connectors alone cannot enforce.

Pass-through authentication (PTA) uses a lightweight agent on-premises to validate user credentials directly against Active Directory. When users sign in, their passwords are encrypted and sent to the agent, which verifies them with domain controllers. This meets the requirement of direct validation without storing passwords in the cloud. It provides a seamless experience and is ideal when organizations want to enforce on-premises password policies in real time.

Password Hash Synchronization continuously replicates on-premises password hashes to Microsoft Entra ID, so any password change made in Active Directory is reflected in the cloud within minutes. This directly satisfies the stem's requirement for near-immediate synchronisation of on-premises password changes, without requiring users to authenticate against on-premises infrastructure.

Microsoft Purview Data Lifecycle Management (DLM), formerly known as Microsoft 365 Records Management, is the primary service within Microsoft Purview for managing the entire lifecycle of an organization's data. It enables the creation and application of retention labels and policies to define how long content should be kept, whether for regulatory compliance, legal hold, or business requirements, and when it should be permanently deleted. This ensures that data is retained for the necessary period and then defensibly disposed of according to established policies, directly addressing compliance department requirements for data retention and deletion.

Microsoft 365 Defender is the correct solution as it provides a unified Extended Detection and Response (XDR) experience specifically tailored for the Microsoft 365 ecosystem. It automatically collects, correlates, and analyzes security signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated approach enables cross-domain threat protection, automated investigation, and remediation across email, endpoints, identities, and cloud applications, offering a holistic view of an organization's security posture within Microsoft 365.

Microsoft Purview Audit (Premium) is the appropriate solution for retaining audit logs for two years, as it offers a default retention of one year, which can be extended to up to 10 years for specific activities. This service provides advanced auditing capabilities, including higher-fidelity logging, faster access to audit data, and increased API bandwidth, making it suitable for meeting stringent regulatory compliance requirements for long-term audit log retention.

Microsoft Purview Information Protection (MIP) is the correct solution because it enables organizations to discover, classify, label, and protect sensitive data, including Protected Health Information (PHI) relevant to HIPAA. Sensitivity labels can be applied manually or automatically based on content inspection (e.g., detecting medical record numbers or other sensitive info types), enforcing encryption, visual markings, and access restrictions. This ensures that data is protected at rest and in transit, aligning directly with HIPAA's security rule requirements for safeguarding electronic PHI.

Microsoft Defender for Cloud is the correct solution as it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) across Azure, on-premises, and multi-cloud environments. It continuously assesses security posture, offers a secure score, monitors regulatory compliance against various benchmarks, and delivers integrated threat detection and protection for Azure Virtual Machines and hybrid servers via Azure Arc.

External Identities is the overarching capability within Microsoft Entra ID that enables secure interaction with external users. Specifically, the social identity providers feature allows external users to sign in to your Microsoft Entra ID-protected applications using their existing credentials from popular social accounts like Google, Facebook, LinkedIn, or Amazon. This eliminates the need for external users to create a new account or have an existing Microsoft Entra ID or Microsoft account, streamlining access for a broad range of external collaborators.

Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and automatically protect sensitive information across various locations, including endpoints, cloud apps, and services like Exchange, SharePoint, and OneDrive. By detecting specific sensitive information types or content, DLP can actively block sharing, encrypt data, or notify users and administrators in real-time. This direct enforcement capability is crucial for preventing unauthorized data exfiltration or sharing.

Confidentiality, a cornerstone of the CIA triad, ensures that information is accessible only to those authorized to view it. This principle directly addresses the company's security measure to limit access to specific employees, preventing unauthorized disclosure of sensitive data. Implementing strong access controls, encryption, and data classification are typical methods to uphold confidentiality, aligning perfectly with the goal of restricting information access.

Advanced hunting is a powerful, proactive threat-hunting tool within Microsoft Defender XDR that allows security analysts to explore raw event data using Kusto Query Language (KQL). It provides access to up to 30 days of historical data from endpoints, identities, cloud apps, and email, enabling the discovery of unknown or advanced threats that automated detections might miss. This capability is crucial for deep investigations and creating custom detection rules.

The action "blockOnlyExternal" specifically prevents external users from accessing content that contains sensitive information, but it does not prevent internal users from initially sharing or sending that content to external recipients. While external access to the shared content might be blocked, the internal user successfully initiated the sharing action. This distinction is crucial because the policy allows the internal user to perform the outbound sharing, even if the external recipient cannot ultimately view the sensitive data within the shared item.

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP can detect specific sensitive data types, such as credit card numbers or personally identifiable information (PII), and enforce rules to prevent sharing, copying, or transferring this data outside defined organizational boundaries. It directly fulfills the requirement to automatically block sharing actions based on content.

The Attack graph in Microsoft Defender XDR specifically visualizes the full scope of an attack, including how an attacker moved laterally, which assets were impacted, and the relationships between entities. It provides a rich, interactive representation of the attack chain, making it ideal for understanding lateral movement paths and identifying potential pivot points. This feature is crucial for incident responders to trace the progression of sophisticated threats.

Combining both grant controls within one conditional access policy enforces MFA and blocks non-compliant devices at sign-in, matching the untrusted-network and Intune compliance conditions. Both requirements must be satisfied before access is granted, so AND logic is required.

When a Microsoft Purview DLP policy is configured in "Test mode," it is designed to evaluate policy matches and generate incident reports without enforcing any configured actions, such as blocking access or notifying users. This mode allows administrators to assess the policy's impact and fine-tune its rules before full deployment. Consequently, any specified actions, like blocking access to a credit card number, will not be enforced while the policy remains in test mode.

Microsoft Intune is a cloud-based Unified Endpoint Management (UEM) solution specifically designed to manage and secure devices, including mobile phones, tablets, and laptops, across various operating systems. It enables organizations to centrally deploy and enforce security policies, manage application lifecycles, and configure compliance settings, ensuring all managed devices meet organizational security and operational standards. This direct device configuration and policy enforcement capability is precisely what the question asks for.

Cloud Workload Protection Platform (CWPP) is a key feature of Microsoft Defender for Cloud. This capability provides comprehensive protection for diverse cloud workloads, including virtual machines, containers, databases, and storage, across multi-cloud and hybrid environments. Defender for Cloud offers vulnerability assessments, just-in-time access, adaptive application controls, and file integrity monitoring to secure these critical compute resources against threats.

Compliance Manager provides framework-specific assessments against GDPR and ISO 27001, with a compliance score, prioritised improvement actions, and tracking of implementation progress. It satisfies the requirement for a single centralised tool covering posture assessment and ongoing action tracking.

The Regulatory compliance dashboard, a core feature of Microsoft Defender for Cloud, provides a centralized view to manage and track an organization's compliance posture against various regulatory standards. It allows users to add built-in standards like HIPAA and HITRUST, crucial for healthcare organizations, and continuously monitors the environment, mapping security recommendations to specific controls within these frameworks. This dashboard presents a compliance score and actionable recommendations, enabling organizations to efficiently demonstrate adherence to industry-specific regulations.

An automation rule in Microsoft Sentinel is the primary mechanism for orchestrating automated responses to incidents or alerts. These rules allow administrators to define conditions based on incident or alert properties, and then automatically perform actions such as suppressing false positives, assigning incidents, or, most importantly, triggering a playbook (Azure Logic App) to execute complex response workflows. This direct linkage to playbooks is precisely how Contoso can automate its incident response processes.

Microsoft Purview Compliance Manager is the correct solution as it provides a comprehensive dashboard to assess and manage an organization's compliance posture against various regulatory standards and industry benchmarks. It offers a real-time compliance score, recommended improvement actions, and the ability to assign and track tasks to address identified gaps. This tool is specifically designed to help multinational corporations navigate complex regulatory landscapes by simplifying compliance management and demonstrating adherence.

DLP policies for Teams proactively identify and prevent the sharing of sensitive information, such as credit card numbers or health records, within Teams chats, channels, and files. These policies leverage sensitive information types and trainable classifiers to detect data and can automatically block sharing, notify users, or require justification before allowing the action, directly protecting against data exfiltration.

Confidentiality is the fundamental security principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. It directly addresses the requirement of limiting access to customer data only to those who are explicitly authorized, typically through mechanisms like encryption, access control lists (ACLs), and the principle of least privilege. This principle is paramount for protecting sensitive information from unauthorized viewing or exposure, aligning perfectly with the stated security policy.

Microsoft Purview Information Protection enables organizations to discover, classify, and protect sensitive data like Protected Health Information (PHI) through sensitivity labels, which can automatically apply encryption or visual markings. Concurrently, Microsoft Purview Data Loss Prevention (DLP) policies leverage these classifications to detect and prevent unauthorized sharing or transfer of PHI across various locations, including email, SharePoint, and Teams. This combined approach ensures data is appropriately handled, retained, and safeguarded against exfiltration, directly addressing HIPAA's privacy and security requirements.

Federation establishes a trust relationship between an identity provider (IdP) and one or more service providers (SPs), enabling users to authenticate once with the IdP and gain access to multiple SPs without re-entering credentials. This mechanism, often leveraging protocols like SAML or OpenID Connect, allows the IdP to assert a user's identity to various applications. It is the core technology that facilitates single sign-on (SSO) across different applications and organizational boundaries.

Integrity ensures data has not been tampered with or corrupted during transit or storage. When a user downloads a software update, comparing its cryptographic hash (e.g., SHA256) with a known, trusted hash value provided by the company directly verifies that the file's contents are exactly as intended. This process specifically confirms the data's integrity, ensuring the downloaded software is free from unauthorized modifications or accidental damage.

Conditional Access policies in Microsoft Entra ID provide the precise control needed to enforce requirements based on identity types. By configuring a policy to include the 'Guest or external users' identity type, administrators can specifically mandate multi-factor authentication (MFA) solely for B2B collaboration guests and other external identities. This direct targeting ensures that internal users are not affected, thereby accurately meeting the requirement to enforce MFA exclusively for external users.

Just-in-time (JIT) VM access is a crucial security feature in Azure Defender for Cloud that significantly reduces the attack surface of virtual machines. It achieves this by locking down inbound network traffic to VMs, typically via Network Security Groups (NSGs), allowing only authorized users to request temporary, time-limited access to specific ports. This access is automatically revoked after a configurable duration, ensuring that ports are only open precisely when needed, thereby minimizing exposure for production database VMs.

Managing user access and classifying data stored within the SaaS application are critical customer responsibilities. The customer defines who can access their organizational data, what permissions they have, and how sensitive that data is, directly impacting data governance and compliance. This ensures that customer-specific information remains secure and properly handled according to internal policies and regulatory mandates.

Microsoft Defender for Office 365 provides Safe Links, which rewrites and scans URLs at time of click, blocking known malicious destinations in real time. It also detonates URLs within attachments in a sandbox before delivery, satisfying the stem's requirement for both time-of-click verification and attachment sandboxing.

Encryption is a primary control for ensuring confidentiality by transforming data into an unreadable format, known as ciphertext. This process prevents unauthorized individuals from accessing or understanding the sensitive patient records, even if they manage to intercept or steal the encrypted data. Only authorized parties possessing the correct decryption key can revert the data to its original, readable form, thereby protecting against unauthorized disclosure.

This policy action, often referred to as 'Block with override' in Microsoft Purview Data Loss Prevention (DLP) configurations, is designed to prevent sensitive data from being shared inappropriately. However, it provides a crucial flexibility: users are prompted to provide a business justification if they believe their action is legitimate, allowing them to bypass the block. This approach balances stringent data protection with operational continuity, empowering users to make informed decisions when necessary.

Microsoft Defender for Cloud Apps provides Cloud Discovery to identify shadow IT apps, risk scoring, and app governance controls including session and data-sharing policies for sanctioned services like Box and Dropbox, matching the discovery, assessment, and control requirements.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is explicitly designed for centralizing security data from virtually any source, including Microsoft services, on-premises infrastructure, and other cloud providers. This enables comprehensive threat detection through AI and machine learning, alongside automated responses to security incidents across the entire enterprise.

A retention policy in Microsoft Purview allows administrators to set a retention period (e.g., 5 years) and an action (such as automatic deletion) for content in SharePoint sites. Users cannot permanently delete the content until the retention period expires.

Microsoft Entra ID Protection is specifically designed to detect, report, and automatically remediate identity-based risks, such as unusual sign-in locations, impossible travel, and multiple failed sign-in attempts. It leverages machine learning to identify suspicious activities and can configure policies to automatically block access or enforce multi-factor authentication (MFA) when a user's risk level is deemed high. This capability directly addresses the scenario of an account lockout due to multiple failed sign-ins by identifying and responding to the underlying risk.

Deploying a mission-critical customer portal across multiple Azure regions with automatic failover directly addresses the 'A' in the CIA triad: Availability. This strategy ensures that the portal remains continuously accessible and operational for authorized users, even if an entire geographic region experiences a catastrophic outage. The primary objective is to minimize downtime and provide uninterrupted service, which is paramount for mission-critical systems.

This option is correct because the KQL query explicitly includes the condition `EntityType == 'File'`, which is designed to retrieve data specifically related to file system events. This filter ensures that the investigation focuses on activities such as file creation, modification, deletion, or access attempts on endpoints. Therefore, the alert evidence being examined directly corresponds to file entities within the Microsoft 365 Defender data schema, making this the appropriate choice.

Microsoft Entra Conditional Access is a powerful policy engine that allows organizations to enforce specific access requirements based on various conditions, including user identity, device state, location, and application being accessed. By configuring a Conditional Access policy, administrators can precisely target individual cloud applications and mandate multi-factor authentication as a grant control for access, thereby meeting the requirement to enforce MFA per application. This granular control ensures security without unnecessarily impacting all users or applications.

Data Loss Prevention in Microsoft Purview inspects email content and can detect the phrase 'Confidential-Financial' in the subject or body, then block or restrict the message regardless of recipient domain. This satisfies the requirement to stop external sharing automatically.

Data Loss Prevention (DLP) in Microsoft 365 is specifically designed to identify, monitor, and protect sensitive information across various locations, including email, SharePoint, and OneDrive. It uses sensitive information types (SITs) to detect data like credit card numbers or PII, allowing organizations to define policies that block sharing, encrypt content, or notify users and administrators. This capability directly addresses the need to prevent accidental or malicious sharing of sensitive data, often providing user override options for legitimate business cases.

Microsoft Entra B2B collaboration is the correct solution, enabling organizations to securely share applications and resources with external users from partner companies. It allows these invited guest users to sign in using their existing corporate credentials from their home directory (e.g., another Microsoft Entra tenant, a federated identity provider, or even social identities), eliminating the need for partners to create new accounts in the inviting tenant. This streamlines access while maintaining security and partner identity management.

This correctly identifies that conditions (sign-in risk and locations) are used to define when the policy applies, and Grant controls enforce the requirements. The Grant control 'Require all the selected controls' can combine device compliance and MFA.