Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the concepts of security, compliance, and identityHard
A global organization uses Microsoft 365 and Azure services. They want to ensure that employees based in different geographical regions receive varied levels of access to sensitive internal applications, based on their location and the device they are using. For example, access might be denied if an employee tries to access from an unmanaged device outside of the corporate network. Which identity and access concept is best suited to enforce these dynamic access policies?
- AIdentity Governance
- BRole-Based Access Control (RBAC)
- CPrivileged Identity Management (PIM)
- DConditional Access
Show answer & explanationAnswer & explanation
Correct answer: D. Conditional Access
Conditional Access allows organizations to enforce policies that evaluate conditions (like user location, device state, application being accessed) in real-time to determine if access should be granted, denied, or require additional authentication. This directly matches the need for dynamic access based on location and device.
Why the other options are wrong
- A. Identity Governance focuses on managing the identity lifecycle, access reviews, and entitlement management, not dynamic access decisions based on real-time conditions.
- B. RBAC assigns permissions based on job functions, which is static and doesn't consider dynamic conditions like location or device state.
- C. Privileged Identity Management (PIM) manages temporary, just-in-time access for privileged roles, not general dynamic access for all users based on conditions.
Conditional Access
An Azure AD feature that allows organizations to enforce policies based on specific conditions, such as user location, device compliance, or application sensitivity, to grant or deny access.
- Evaluates access requests in real-time.
- Can require MFA, block access, or enforce device compliance.
- Integrates with Azure AD, Intune, and other services.
Memory trick: Conditional Access is like a 'smart traffic light' for logins, checking conditions before letting you pass.