Describe the capabilities of Microsoft Entra →hardMultiple Choice

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "conditions": {
    "users": {
      "includeUsers": ["All"]
    },
    "clientAppTypes": ["browser"]
  },
  "grantControls": {
    "builtInControls": ["compliantDevice", "domainJoined"],
    "operator": "OR"
  }
}
```

Refer to the exhibit. A user accesses a web app from a device that is Microsoft Entra joined but not Intune compliant. Which condition will be satisfied?

⚠ Common exam trap

Candidates often mistakenly confuse 'Microsoft Entra joined' with 'Domain joined' in Conditional Access. The 'Domain joined' condition specifically requires a *Hybrid Microsoft Entra ID joined* device (joined to on-premises AD and registered with Microsoft Entra ID), not just a Microsoft Entra joined device. This is a common point of confusion regarding device states in Conditional Access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Neither condition

The exhibit shows a Conditional Access policy that requires both 'Domain joined' and 'Compliant device' conditions. The device is Microsoft Entra joined. In Conditional Access, the 'Domain joined' condition specifically refers to devices that are *Hybrid Microsoft Entra ID joined* (joined to an on-premises Active Directory and registered with Microsoft Entra ID). A device that is *only* Microsoft Entra joined does not satisfy the 'Domain joined' condition. Additionally, the device is stated as 'not Intune compliant', so it fails the 'Compliant device' condition. Therefore, neither the 'Domain joined' nor the 'Compliant device' condition is satisfied, making option B correct.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Domain joined
Why it's wrong here
The 'Domain joined' condition in Microsoft Entra Conditional Access policies is met when a device is either traditionally Active Directory domain-joined, Microsoft Entra joined, or Microsoft Entra hybrid joined. Since the exhibit states the device is Microsoft Entra joined, it successfully satisfies this specific condition, allowing the policy to proceed with its evaluation based on this criterion.
✓
Neither condition
Why this is correct
The device *does* satisfy at least one of the specified conditions. Specifically, the device being Microsoft Entra joined fulfills the 'Domain joined' requirement as interpreted by Conditional Access. Consequently, stating that neither condition is met is a false assessment of the device's state against the policy.
✗
Compliant device
Why it's wrong here
A 'Compliant device' condition requires the device to be registered with an MDM solution, such as Microsoft Intune, and to adhere to all assigned device compliance policies. The problem statement explicitly indicates that the device is not Intune compliant, meaning it fails to meet the security posture requirements defined by the organization. Therefore, this condition is not satisfied.
✗
Both conditions
Why it's wrong here
For the 'Both conditions' statement to be true, the device would need to simultaneously satisfy both the 'Domain joined' and 'Compliant device' criteria. While the device successfully meets the 'Domain joined' condition through its Microsoft Entra join status, it fails the 'Compliant device' check. Since one of the two required conditions is not met, the overall 'Both conditions' assessment is false.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question