Describe the capabilities of Microsoft security solutions →easyMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
{
  "properties": {
    "displayName": "MFA for Admins",
    "conditions": {
      "applications": { "includeApplications": ["All"] },
      "users": { "includeRoles": ["Global Administrator"] },
      "clientAppTypes": ["All"]
    },
    "grantControls": {
      "builtInControls": ["mfa"],
      "operator": "OR"
    }
  }
}

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. What will this policy do?

⚠ Common exam trap

A common mix-up: candidates assume a policy targeting 'Global Administrators' with MFA only applies to the Azure portal, but the 'All cloud apps' condition extends the requirement to every cloud application the admin accesses.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Require MFA for Global Administrators accessing any application

The policy targets 'Global Administrators' and the 'All cloud apps' condition, then requires 'Require multi-factor authentication' as the access control. This means any Global Administrator attempting to access any application (not just the Entra admin center) must satisfy MFA. Option C correctly captures this scope.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Block access for Global Administrators unless they use MFA
Why it's wrong here
The policy's "Grant" control is explicitly configured to "Require multifactor authentication," which mandates that users must successfully complete an MFA challenge to gain access. It does not select the "Block access" control, which would unconditionally deny access regardless of MFA status. Therefore, the policy enforces the use of MFA as a condition for access, rather than outright blocking access if MFA is not presented. This distinction is crucial for understanding the policy's effect.
✗
Require MFA for all users
Why it's wrong here
This statement is incorrect because the conditional access policy's "Users and groups" assignment is precisely scoped to "Directory roles" and then specifically to "Global Administrator." This configuration ensures that the policy's conditions and access controls apply exclusively to accounts holding the Global Administrator role, rather than encompassing all users within the Microsoft Entra tenant. Therefore, it does not require MFA for every user.
✓
Require MFA for Global Administrators accessing any application
Why this is correct
This statement accurately describes the conditional access policy's intended behavior and configuration. The policy's "Users and groups" condition is configured to target the "Global Administrator" directory role, ensuring only these privileged accounts are affected. Concurrently, the "Cloud apps or actions" condition is set to "All cloud apps," meaning it applies universally to any application accessed by these administrators. Finally, the "Grant" control enforces "Require multifactor authentication" for these specific users across all applications.
✗
Require MFA for users accessing the Microsoft Entra admin center only
Why it's wrong here
The conditional access policy's "Cloud apps or actions" condition is configured to include "All cloud apps" rather than specific applications. This broad scope dictates that the policy applies to every application integrated with Microsoft Entra ID, not solely to the Microsoft Entra admin center. If the policy were intended to target only the admin center, specific applications would need to be explicitly selected within the "Cloud apps or actions" condition.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question