SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Exhibit
{
"ConditionalAccessPolicy": {
"Name": "Require MFA for External Users",
"Conditions": {
"UsersAndGroups": {
"IncludeExternalUsers": true
},
"Applications": {
"IncludeAll": true
}
},
"Controls": {
"Grant": {
"RequireMfa": true
}
}
}
}You have a Conditional Access policy in Microsoft Entra ID. The policy has the following settings: Assignments > Users > Include: All guest and external users; Assignments > Target resources > Cloud apps: All cloud apps; Access controls > Grant: Require multi-factor authentication. What is the effect of this policy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Requires MFA for all external users accessing any cloud app
The policy applies to all guest and external users and targets all cloud apps, with the grant control requiring multi-factor authentication. Therefore, it requires MFA for all external users accessing any cloud app. It is not limited to guest users only, does not apply to all internal users, and does not exclude external users with the Global Administrator role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Requires MFA for all external users accessing any cloud app
Why this is correct
The policy targets all guest and external users and all cloud apps, with MFA as the grant control. Every external user sign-in to any cloud application must therefore complete multi-factor authentication, satisfying the stated assignment and access control configuration.
- ✗
Requires MFA for guest users only
Why it's wrong here
Guest and external users are distinct directory classifications; the include covers both, so external users who are not guests are also in scope. It is tempting because guest is the more familiar category, but the assignment explicitly names both, widening enforcement beyond guests alone.
- ✗
Requires MFA for all users accessing all cloud apps
Why it's wrong here
The policy's user assignment scopes it to guest and external users only, so members and internal users are unaffected. It is tempting because the cloud apps assignment covers all apps, but that breadth applies only to the included user set, not to every identity in the tenant.
- ✗
Requires MFA for external users except those with global admin role
Why it's wrong here
Conditional Access policies apply to global administrators unless they are explicitly excluded in the assignment; no such exclusion exists here. It is tempting because directory role settings can exempt admins, but that is separate from policy scope, which still includes them.
Go deeper
Related to this question
Learn chapter
Cloud App Governance and App Consent
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled, applies to all cloud apps, and is configured to include users assigned to the Global Administrator or Exchange Administrator roles. Which users are affected by this policy?
easy- A.All users who are members of any Azure AD administrative role
- B.All users who are members of the Global Administrator role only
- ✓ C.All users who are members of the Global Administrator or Exchange Administrator role
- D.All users in the organization
Why C: The conditional access policy includes users assigned to the Global Administrator or Exchange Administrator roles. Therefore, only users with those specific roles are affected. It does not include all administrative roles or all users in the organization.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.