SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?
⚠ Common exam trap
Many exam-takers confuse the role of Intune's device compliance policy (which only defines and reports compliance) with the Conditional Access policy (which enforces the access decision), leading them to select Option D instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A conditional access policy in Microsoft Entra ID
Conditional Access policies in Microsoft Entra ID (formerly Azure AD) are the correct mechanism to enforce access controls based on device compliance status. By integrating with Intune's device compliance policies, a Conditional Access policy can block or allow access to corporate email (e.g., Exchange Online) based on whether the device is marked as compliant. This is the standard approach for controlling access to cloud apps like email based on device health.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An app protection policy in Microsoft 365 admin center
Why it's wrong here
An app protection policy in Microsoft Intune (often configured via Microsoft 365 admin center for basic scenarios, but primarily Intune) manages data protection at the application level, not the device level. These policies enforce settings like requiring a PIN to open an app, preventing copy/paste of organizational data to unmanaged apps, or encrypting app data. They do not assess device-wide compliance criteria (e.g., OS version, encryption status) or block access to resources based on a device's overall health.
- ✓
A conditional access policy in Microsoft Entra ID
Why this is correct
A conditional access policy in Microsoft Entra ID is the correct mechanism for enforcing access controls based on device compliance. These policies evaluate various signals, including whether a device is marked as 'compliant' by Microsoft Intune, before granting access to cloud applications and resources. By requiring a compliant device, organizations ensure that only trusted and healthy endpoints can access sensitive data, directly addressing the need to block access for non-compliant devices.
- ✗
A conditional access policy in Azure AD
Why it's wrong here
While Conditional Access policies are indeed configured within the service now known as Microsoft Entra ID, referring to it as 'Azure AD' uses outdated terminology. In the context of a Microsoft certification exam like SC-900, precision in naming is crucial. Although the underlying functionality is the same, using the current and officially recognized name, 'Microsoft Entra ID,' is expected for a technically accurate answer.
- ✗
A device compliance policy in Intune
Why it's wrong here
A device compliance policy in Microsoft Intune defines the specific security requirements a device must meet to be considered 'compliant' (e.g., minimum OS version, disk encryption, antivirus presence). While essential for *determining* a device's compliance status, these policies alone do not block access to resources. Their primary function is to report the device's compliance state to Microsoft Entra ID, which then, in conjunction with a Conditional Access policy, enforces access restrictions.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.