SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only devices that are enrolled in Intune and compliant with your organization's security policies can access corporate email. Which Microsoft Entra feature should you use?
⚠ Common exam trap
Many exam-takers confuse Conditional Access with Privileged Identity Management (PIM) because both involve access control, but PIM focuses on privileged roles, not device compliance enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Conditional Access
Microsoft Entra Conditional Access is the correct feature because it enforces policy-based access controls that evaluate device compliance status reported by Microsoft Intune. By configuring a Conditional Access policy to require 'Device to be marked as compliant,' only devices enrolled in Intune and meeting security policies can access corporate email, leveraging the integration between Entra ID and Intune.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Entitlement Management
Why it's wrong here
Microsoft Entra Entitlement Management is part of Microsoft Entra Identity Governance, designed to manage access to resources for internal and external users through access packages. It automates the lifecycle of access assignments based on user attributes or roles, but it does not evaluate device compliance or health as a condition for granting access. Its focus is on user access provisioning, not device posture enforcement.
- ✓
Microsoft Entra Conditional Access
Why this is correct
Microsoft Entra Conditional Access policies evaluate various signals, including user, location, application, and device state, to make real-time access decisions. By integrating with Microsoft Intune, Conditional Access can enforce that devices must be marked as compliant before users can access corporate resources, directly addressing the need for device-based access control. This mechanism ensures only trusted devices can connect.
- ✗
Microsoft Entra Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) access, time-bound access, and approval workflows for privileged roles, but it does not assess or enforce device compliance as a prerequisite for access. PIM's primary function is elevating user permissions, not validating device security posture.
- ✗
Microsoft Entra Terms of Use
Why it's wrong here
Microsoft Entra Terms of Use policies require users to accept an organization's terms before gaining access to specific applications or resources. This feature ensures user awareness and consent regarding organizational policies, but it does not perform any evaluation of the device's security posture or compliance status. It's a user-centric acknowledgment mechanism, not a device-centric enforcement tool.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.