Describe the capabilities of Microsoft Entra →mediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit.
{
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    },
    "locations": {
      "includeLocations": ["AllTrusted"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa"]
  }
}

Refer to the exhibit. The JSON shows a conditional access policy. What is the effect of this policy?

⚠ Common exam trap

Candidates often confuse 'Require MFA' with 'Block access' or assume that trusted locations imply automatic access without MFA, when in fact the policy explicitly requires MFA even from trusted locations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Requires MFA for Office 365 from trusted locations.

The policy assigns the 'Require multifactor authentication' grant to Office 365 cloud apps, and the condition restricts it to 'trusted locations' (typically corporate networks or compliant IP ranges). This means users accessing Office 365 from those trusted locations must complete MFA, while access from untrusted locations is not affected by this policy (it may be handled by other policies). Option A correctly describes this effect.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Requires MFA for Office 365 from trusted locations.
Why this is correct
The policy's grant control explicitly states 'Require multi-factor authentication,' which means users must successfully complete an MFA challenge to gain access. When combined with a condition that specifies access to Office 365 from 'trusted locations,' this policy ensures enhanced security even from known network perimeters. It mandates an additional layer of identity verification for these specific access attempts. This configuration aligns perfectly with the principle of least privilege and Zero Trust.
✗
Applies only to external guest users.
Why it's wrong here
This statement is incorrect because a Conditional Access policy configured to apply to 'All users' encompasses every user identity within the Azure AD tenant, including both internal members and external guests. It does not restrict its scope exclusively to external guest users. To target only external guest users, the policy's 'Users and groups' condition would need to be specifically configured to include or exclude 'Guest or external users' rather than 'All users'.
✗
Blocks all access to Office 365 from trusted locations.
Why it's wrong here
This option is inaccurate because the specified grant control is 'Require multi-factor authentication,' not 'Block access.' Requiring MFA allows access to Office 365 resources *after* the user successfully completes a second verification step, such as a phone call or authenticator app notification. A 'Block access' grant control would outright deny all access attempts, regardless of the user's ability to perform MFA, which is a fundamentally different security posture.
✗
Requires a compliant device for Office 365.
Why it's wrong here
This option is incorrect because the policy's grant control is set to 'Require multi-factor authentication,' which focuses on verifying the user's identity through multiple factors. A requirement for a 'compliant device' is a distinct grant control that mandates the device accessing the resource meets specific security standards, such as being enrolled in Intune and passing compliance policies. These are separate security requirements within Conditional Access, and the policy in question does not specify device compliance.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question