Describe the capabilities of Microsoft Entra →hardMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    },
    "locations": {
      "includeLocations": ["All"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa", "compliantDevice"],
    "operator": "AND"
  }
}
```

Refer to the exhibit. The Conditional Access policy shown is applied to all users accessing Office 365. A user with a compliant device but no MFA registered attempts to access Exchange Online. What will happen?

⚠ Common exam trap

It's easy for candidates to assume a compliant device automatically satisfies Conditional Access policies, but the policy explicitly requires MFA registration, and device compliance is irrelevant unless included as a grant control.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Access is blocked

The Conditional Access policy requires MFA registration for all users accessing Office 365 cloud apps. Since the user has not registered MFA, the policy's grant control (Require MFA registration) is not satisfied, and the policy blocks access. The device compliance status is irrelevant because the policy does not include device compliance as a grant control.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Access is blocked
Why this is correct
This policy explicitly requires both multi-factor authentication (MFA) and a compliant device as grant controls. For access to be permitted, all specified grant controls must be satisfied simultaneously. Since the user has not registered for MFA, this critical requirement is not met, leading to the conditional access policy blocking the access attempt.
✗
Access is granted because the policy is only for Office 365 and the user uses Exchange Online
Why it's wrong here
The 'Office 365' cloud app scope in Conditional Access policies is a comprehensive collection that includes core Microsoft 365 services like Exchange Online, SharePoint Online, and Teams. Therefore, a policy targeting 'Office 365' absolutely applies when a user attempts to access Exchange Online. The policy's scope is correctly applied, but access is denied due to unmet grant controls, not a scope mismatch.
✗
Access is granted after MFA registration prompt
Why it's wrong here
While a user might be prompted to register for MFA in certain scenarios, a Conditional Access policy configured with 'Require multi-factor authentication' as a grant control evaluates this condition *before* granting access. The policy demands that MFA is already satisfied or fully registered and ready for use. Simply being prompted for registration does not fulfill the policy's immediate grant requirement for access, especially when other controls are also mandated.
✗
Access is granted because the device is compliant
Why it's wrong here
Conditional Access policies with multiple grant controls, such as 'Require multi-factor authentication' AND 'Require device to be marked as compliant', operate on an 'AND' logic. This means every single specified grant control must be successfully met for access to be granted. Even if the device is compliant, the failure to satisfy the concurrent requirement for multi-factor authentication results in the access attempt being blocked.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question