SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to allow employees to securely access internal applications from their personal devices. The security policy requires that access is only granted if the device is compliant with company security policies (e.g., encryption enabled, password required, up-to-date operating system). Which Microsoft Entra ID capability should they use?
⚠ Common exam trap
Many candidates confuse Identity Protection (risk-based conditional access) with device compliance Conditional Access, but Identity Protection does not evaluate device health or compliance policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access in Microsoft Entra ID is the correct capability because it allows administrators to define policies that enforce device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can require that devices meet specific security policies—such as encryption, password requirements, and OS updates—before allowing access. This directly addresses the requirement to grant access only from compliant personal devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access
Why this is correct
Conditional Access policies in Microsoft Entra ID are fundamental for implementing Zero Trust principles by evaluating specific conditions before granting access. These policies can enforce requirements such as multifactor authentication, specific location, or crucially, that a device must be marked as compliant by Microsoft Intune. This ensures that only trusted devices meeting organizational security standards can access internal applications, directly addressing the need for secure access from compliant endpoints.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is designed to detect, investigate, and remediate identity-based risks, such as anomalous sign-ins, impossible travel, or leaked credentials. While it can feed risk signals into Conditional Access policies, its primary function is focused on user and sign-in risk assessment, not on directly evaluating or enforcing the compliance status of the device itself. It helps protect identities from compromise rather than ensuring device health for application access.
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) within Microsoft Entra ID focuses on managing, controlling, and monitoring access to important resources by providing just-in-time (JIT) and time-bound access to privileged roles. Its core purpose is to mitigate the risks associated with standing administrative access by requiring users to activate roles only when needed. PIM does not assess the security posture or compliance of the device being used; it strictly governs the elevation and duration of user permissions.
- ✗
Microsoft Entra Verified ID
Why it's wrong here
Microsoft Entra Verified ID is a decentralized identity solution that empowers individuals to own and control their digital identities through verifiable credentials. It enables organizations to issue digital proofs of identity, such as employment or educational status, which users can then present to verify attributes without sharing underlying personal data. This service is focused on secure, privacy-preserving identity verification, not on enforcing device compliance for accessing internal applications.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Network Access Control
Network Access Control is a security solution that enforces policies to control which devices and users can connect to a network, ensuring only authorized and compliant endpoints gain access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.