Describe the capabilities of Microsoft Entra →hardMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

{
  "signInEvents": [
    {
      "userPrincipalName": "jdoe@contoso.com",
      "appDisplayName": "Microsoft 365 Exchange Online",
      "clientAppUsed": "Mobile Apps and Desktop clients",
      "deviceDetail": {
        "deviceId": "",
        "displayName": "",
        "operatingSystem": "iOS",
        "browser": ""
      },
      "location": "US",
      "riskLevelDuringSignIn": "medium",
      "riskLevelAggregated": "medium",
      "riskEventTypes": ["unfamiliarFeatures"],
      "mfaRequired": false,
      "status": {
        "errorCode": 0,
        "failureReason": ""
      }
    }
  ]
}

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs for a user. The user successfully signed in from a mobile device running iOS, located in the US, with medium risk level. The sign-in did not require MFA. You have a Conditional Access policy that requires MFA for all users when sign-in risk is medium or higher. Why was MFA not triggered?

⚠ Common exam trap

Many exam-takers assume a medium risk level always triggers MFA, overlooking the client apps exclusion condition that can bypass the policy for specific device types.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Conditional Access policy may exclude 'Mobile Apps and Desktop clients' client apps.

The Conditional Access policy can be configured to exclude specific client apps, such as 'Mobile Apps and Desktop clients'. If the policy excludes these client apps, the sign-in from an iOS mobile device would not be subject to the MFA requirement, even though the sign-in risk is medium. The sign-in logs confirm MFA was not required, indicating the policy did not apply to this client app type.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The Conditional Access policy may exclude 'Mobile Apps and Desktop clients' client apps.
Why this is correct
Conditional Access policies offer granular control over client applications. If a policy requiring MFA is specifically configured to apply only to 'Browser' client apps, then sign-ins originating from 'Mobile Apps and Desktop clients' would be explicitly excluded from that policy's enforcement. This allows the sign-in to proceed without triggering the MFA requirement, as the policy's scope does not encompass that particular client type. Such exclusions are common for compatibility or specific use cases.
✗
The device is not compliant, so MFA was not required.
Why it's wrong here
Device compliance is a critical signal in Conditional Access. If a device is identified as non-compliant, a Conditional Access policy would typically either block access to resources entirely or enforce additional controls, such as requiring MFA or prompting for device remediation. It is highly unlikely that a non-compliant device would result in a successful sign-in *without* MFA if MFA was otherwise expected, as non-compliance usually triggers stricter, not looser, security measures.
✗
The sign-in risk level is medium, which is below the threshold.
Why it's wrong here
Microsoft Entra ID Protection policies, often integrated with Conditional Access, are designed to enforce controls based on sign-in risk levels. If a policy is configured to require MFA for 'Medium' or higher sign-in risk, then a sign-in attempt evaluated as 'Medium' risk *should* unequivocally trigger the MFA requirement. Therefore, if MFA was not required, the sign-in risk being medium cannot be the reason for bypassing the expected MFA prompt.
✗
The user is not assigned to the Conditional Access policy.
Why it's wrong here
For any Conditional Access policy to be evaluated and applied, the user attempting to sign in *must* be explicitly included in the policy's scope, either directly or through group membership. If the user were not assigned to the policy, the policy would simply be skipped, and no controls would be enforced. However, the scenario implies a specific condition led to MFA being skipped, suggesting the policy *was* evaluated but a particular condition was met or not met.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question