SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud apps or actions

  Why it's wrong here

  The "Cloud apps or actions" setting within Conditional Access policies specifies which cloud applications or user actions the policy will protect. For instance, it can target access to SharePoint Online, Exchange Online, or specific custom applications. While crucial for defining the scope of protection, this control does not dictate the *method* of authentication (e.g., legacy vs. modern) used by the client application to *reach* those cloud apps. It only determines *which* applications are in scope for the policy.

  When this WOULD be correct

  A question asks: 'A company wants to require MFA for all access to its financial reporting app in Microsoft Entra ID. Which component should be configured?' Here, 'Cloud apps or actions' would be correct to select the specific app.

• ✓

  Conditions (Client apps)

  Why this is correct

  In Azure AD Conditional Access, the "Conditions" section allows administrators to define specific criteria for policy application. The "Client apps" condition specifically targets the type of client application attempting to access resources, including options to block "Other clients," which encompasses legacy authentication protocols like POP3, IMAP, SMTP, and older Office clients. By selecting this option, organizations can enforce the exclusive use of modern authentication clients, significantly enhancing security by eliminating vulnerabilities associated with less secure, basic authentication methods.

• ✗

  Grant

  Why it's wrong here

  Grant controls specify the requirements that must be met *before* a user is granted access to a resource, such as requiring multi-factor authentication (MFA), a compliant device, or a hybrid Azure AD joined device. While these controls enhance security by enforcing additional verification steps, they operate on the *outcome* of authentication (i.e., whether access is granted) rather than blocking the *method* of authentication itself. They do not prevent a legacy client from attempting to authenticate; rather, they would deny access if the legacy client cannot satisfy the grant requirements.

  When this WOULD be correct

  In a scenario where the goal is to require MFA for all cloud app access, the Grant control would be configured to require MFA. For example: 'A company wants to enforce MFA for all users accessing Microsoft 365. Which component should be configured?'

• ✗

  Session

  Why it's wrong here

  Session controls in Conditional Access are applied *after* a user has successfully authenticated and received an access token. These controls manage the user's ongoing session, dictating aspects such as sign-in frequency, persistent browser sessions, or requiring application-enforced restrictions. They are designed to manage the duration and behavior of an active session, not to block or allow the initial authentication protocol used by the client to establish that session in the first place.

  When this WOULD be correct

  A company wants to enforce sign-in frequency for all cloud app sessions, requiring users to re-authenticate every hour. Configuring the Session control with sign-in frequency settings would be the correct approach.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question