Describe the capabilities of Microsoft Entra →mediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit. The exhibit shows a Microsoft Entra ID sign-in log entry:

```json
{
  "id": "abc123",
  "createdDateTime": "2025-12-01T10:00:00Z",
  "userDisplayName": "John Doe",
  "appDisplayName": "Microsoft Azure PowerShell",
  "status": {
    "errorCode": 53003,
    "failureReason": "Blocked by Conditional Access"
  },
  "conditionalAccessStatus": "failure",
  "authenticationRequirement": "multiFactorAuthentication",
  "clientAppUsed": "Azure PowerShell"
}
```

The exhibit shows a sign-in failure for John Doe. The admin wants to allow the sign-in while still enforcing MFA. What should the admin do?

⚠ Common exam trap

A common mix-up: candidates think resetting the password or disabling MFA is the quick fix, but the core issue is that the Conditional Access policy is blocking a client that cannot perform MFA, not that the user's credentials or license are invalid.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Modify the Conditional Access policy to exclude Azure PowerShell or to support MFA for this client.

The sign-in failure is likely caused by a Conditional Access policy that blocks legacy authentication protocols like Azure PowerShell, which do not support MFA natively. Option A is correct because modifying the policy to exclude Azure PowerShell or to require MFA for that client app allows the sign-in while still enforcing MFA for other protocols. This ensures the user can authenticate using a modern authentication flow that supports MFA.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Modify the Conditional Access policy to exclude Azure PowerShell or to support MFA for this client.
Why this is correct
This option correctly identifies that the sign-in failure for John Doe, an admin using Azure PowerShell, is likely due to a Conditional Access policy requiring Multi-Factor Authentication (MFA) that the client cannot satisfy. Azure PowerShell, especially older versions or specific cmdlets, may not fully support modern authentication flows required for MFA. Modifying the policy to either exclude this specific application from the MFA requirement or ensuring the client is updated and configured to properly handle MFA challenges would resolve the access issue while maintaining overall security for other access methods.
✗
Disable MFA for the user.
Why it's wrong here
Disabling Multi-Factor Authentication (MFA) for an administrator user, such as John Doe, is a severe security misstep and directly contradicts the fundamental principle of least privilege and strong authentication. While it might bypass the immediate sign-in failure, it would leave the account highly vulnerable to credential theft, as the Conditional Access policy explicitly mandates MFA for enhanced security. The solution should address the method of MFA enforcement, not eliminate the requirement itself, especially for privileged accounts.
✗
Assign a Microsoft Entra ID P2 license to the user.
Why it's wrong here
Assigning a Microsoft Entra ID P2 license to the user is irrelevant to resolving a Conditional Access policy-related MFA sign-in failure. While P2 licenses unlock advanced features like Identity Protection and Privileged Identity Management, the core functionality of Conditional Access, including the ability to enforce MFA, is available with Microsoft Entra ID P1 licenses or even certain Microsoft 365 subscriptions. The problem lies in the policy's configuration or the client's compatibility, not the user's licensing tier for premium identity features.
✗
Reset the user's password.
Why it's wrong here
Resetting the user's password would not resolve a sign-in failure specifically attributed to a Conditional Access policy requiring Multi-Factor Authentication. The exhibit indicates a failure related to policy enforcement, not an incorrect password entry. If the password were the issue, the error message would typically state 'incorrect password' or similar. This scenario points to the user successfully authenticating with their password but failing to meet the subsequent MFA challenge or other policy conditions.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question