SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company uses Microsoft Entra ID with P1 licenses. You need to implement a policy that blocks access to Microsoft 365 from countries that are not authorized, except for users who are members of a specific security group. Which Microsoft Entra feature should you use?
⚠ Common exam trap
Candidates often confuse Identity Protection (which deals with risk-based policies) with Conditional Access (which handles broader access controls like location), leading them to select A instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy with location condition and group exclusion.
D is correct because Conditional Access policies in Microsoft Entra ID allow you to define access controls based on location conditions, such as blocking access from specific countries. You can then exclude a security group from the block, ensuring that members of that group can still access Microsoft 365 from unauthorized countries. This directly meets the requirement of blocking access except for users in a specific group.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Identity Protection.
Why it's wrong here
Microsoft Entra Identity Protection primarily focuses on detecting and remediating identity-based risks, such as leaked credentials, impossible travel, or anomalous sign-in activities. While it can block risky sign-ins, its core function is not to proactively enforce location-based access restrictions for all users, regardless of risk. It acts reactively to suspicious behavior rather than enforcing a blanket geographic access policy.
- ✗
Microsoft Entra entitlement management.
Why it's wrong here
Microsoft Entra entitlement management is a governance feature designed to manage identity and access lifecycles at scale, particularly for access packages. It allows organizations to define bundles of resources and delegate access approvals, primarily for internal and external users needing temporary or specific access. This service does not provide capabilities to block user access based on their geographic sign-in location.
- ✗
Microsoft Entra B2B collaboration.
Why it's wrong here
Microsoft Entra B2B collaboration enables organizations to securely share applications and resources with external users from other organizations. Its primary function is to facilitate guest user access and management within your tenant, allowing external identities to authenticate. B2B collaboration does not offer policy mechanisms to restrict or block access for either internal or external users based on their physical sign-in location.
- ✓
Conditional Access policy with location condition and group exclusion.
Why this is correct
Conditional Access policies are the definitive tool within Microsoft Entra ID for enforcing granular access controls based on various conditions, including user location. By configuring a policy with a 'Location' condition, administrators can specify trusted or untrusted IP ranges and block access from specific countries or regions. The ability to apply this policy to specific groups while excluding others provides the necessary flexibility to implement targeted access restrictions.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.