Conditional Access User Risk vs Sign-in Risk
Exhibit
Refer to the exhibit.
```json
{
"displayName": "Block high-risk sign-ins",
"conditions": {
"userRiskLevels": ["high"],
"signInRiskLevels": []
},
"grantControls": {
"builtInControls": ["block"]
}
}
```You are troubleshooting a Conditional Access policy in Microsoft Entra ID. The policy in the exhibit is not blocking some sign-ins that you expected to block. What is the most likely reason?
Quick Answer
This is a troubleshooting question, so the fix comes from spotting what's absent from the policy conditions rather than what's present in them: the policy evaluates userRiskLevels but never references signInRiskLevels, so any sign-in with suspicious real-time characteristics — an anonymous IP, an impossible-travel pattern — passes through unblocked as long as the underlying user account itself isn't currently flagged as high risk. User risk and sign-in risk measure genuinely different things in Identity Protection: user risk is a slower-moving, cumulative judgment about whether an account has likely been compromised (built from signals like leaked credentials), while sign-in risk is evaluated fresh on each individual authentication attempt and can flag a single suspicious sign-in even from an otherwise low-risk account. A Conditional Access policy that only checks one of the two will systematically miss whatever the other one is designed to catch. When a scenario describes a policy failing to block sign-ins that look risky in the moment, the diagnostic instinct should be to check whether sign-in risk — not just user risk — is actually included as a condition.
⚠ Common exam trap
Test-takers frequently assume 'risk' in Conditional Access refers to both user and sign-in risk interchangeably, but the exam tests the distinction that these are separate conditions that must be explicitly configured in the policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy only blocks based on user risk, not sign-in risk
The Conditional Access policy shown in the exhibit is configured to block access based on user risk level (e.g., high user risk), but it does not include sign-in risk as a condition. Sign-ins that exhibit suspicious behavior (e.g., from an anonymous IP address) but originate from a user account with low user risk will not be blocked, as the policy only evaluates user risk, not sign-in risk. To block such sign-ins, the policy must also include sign-in risk as a condition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy only blocks based on user risk, not sign-in risk
Why this is correct
The conditions only include userRiskLevels, not signInRiskLevels.
- ✗
The policy is not assigned to any users
Why it's wrong here
No assignment info is shown, but that is not indicated as issue.
- ✗
The grant control is set to allow access
Why it's wrong here
Grant control is set to block.
- ✗
The policy excludes certain users
Why it's wrong here
No exclude clause is shown.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. What will this policy do?
medium- A.Block access when user risk is medium or high
- B.Block sign-ins when sign-in risk is high
- C.Require MFA when user risk is high
- ✓ D.Block access when user risk is high
Why D: The policy JSON specifies `"userRiskLevels": ["high"]` and `"builtInControls": ["block"]`, meaning it blocks access when the user risk level is high. User risk reflects the likelihood that the user's identity is compromised, based on Microsoft's risk detection signals. Option D correctly identifies this behavior.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.