SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grant control 'Require multi-factor authentication'

  Why it's wrong here

  Requiring multi-factor authentication (MFA) ensures a stronger initial verification of user identity by demanding two or more authentication factors. However, once the user successfully completes the MFA challenge, a session token is issued, and the duration of that session is governed by other policies, such as token lifetime or sign-in frequency. MFA itself does not dictate a recurring re-authentication interval within an active session, meaning a user could remain signed in for an extended period after a single MFA challenge.

• ✓

  Session control 'Sign-in frequency'

  Why this is correct

  The 'Sign-in frequency' session control directly addresses the requirement to force re-authentication after a specific time interval. This control mandates that users must re-enter their credentials, potentially including MFA, after a defined period (e.g., 4 hours), even if their session is still active and valid. It ensures periodic re-verification of identity throughout the user's workday, enhancing security by limiting the window of compromise for a stolen session token.

• ✗

  Session control 'Persistent browser session'

  Why it's wrong here

  The 'Persistent browser session' control determines whether a user remains signed in to Microsoft Entra ID after closing and reopening their web browser. This setting primarily affects the continuity of the session across browser instances, allowing users to avoid re-entering credentials when they resume browsing. It does not, however, enforce a specific re-authentication interval *during* an active, continuous session within a single browser instance, which is the core requirement.

• ✗

  Grant control 'Require device to be marked as compliant'

  Why it's wrong here

  The 'Require device to be marked as compliant' grant control ensures that the device attempting to access resources meets the organization's security and compliance standards, as defined by Microsoft Intune. This check verifies device health and configuration at the point of access and can monitor compliance during the session. While critical for endpoint security, this control does not dictate how often the *user* must re-authenticate their identity; the session can persist as long as the device maintains its compliant status.