Describe the concepts of security, compliance, and identity →easyMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Refer to the exhibit.
{
  "properties": {
    "displayName": "MFA for Admins",
    "state": "enabled",
    "conditions": {
      "applications": {
        "includeApplications": ["All"]
      },
      "users": {
        "includeRoles": ["Global Administrator", "Exchange Administrator"]
      },
      "locations": {
        "includeLocations": ["All"]
      }
    },
    "grantControls": {
      "builtInControls": ["mfa"]
    }
  }
}

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled, applies to all cloud apps, and is configured to include users assigned to the Global Administrator or Exchange Administrator roles. Which users are affected by this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

All users who are members of the Global Administrator or Exchange Administrator role

The conditional access policy specifies 'includeRoles' with the Global Administrator and Exchange Administrator roles, meaning only users assigned to either of those roles are affected. Option A is incorrect because the policy does not apply to all administrative roles, only the two specified. Option B is incorrect because it applies to both Global Administrator and Exchange Administrator, not just Global Administrator. Option D is incorrect because the policy does not apply to all users in the organization.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
All users who are members of any Azure AD administrative role
Why it's wrong here
Incorrect. The policy applies only to users with the Global Administrator or Exchange Administrator roles, not all Azure AD administrative roles.
✗
All users who are members of the Global Administrator role only
Why it's wrong here
Incorrect. The policy applies to both Global Administrator and Exchange Administrator roles, not just Global Administrator.
✓
All users who are members of the Global Administrator or Exchange Administrator role
Why this is correct
Correct. The policy includes these two roles specifically.
✗
All users in the organization
Why it's wrong here
Incorrect. The policy does not apply to all users; it is scoped to role members.

Go deeper

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question