Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A security administrator needs to ensure that all users accessing Microsoft Entra ID-integrated applications from unmanaged devices (personal laptops or phones) are automatically required to perform multifactor authentication, regardless of their location. Which Microsoft Entra capability provides this granular control?
- AMicrosoft Entra Conditional Access
- BMicrosoft Entra Access Reviews
- CMicrosoft Entra Privileged Identity Management (PIM)
- DMicrosoft Entra Identity Protection
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft Entra Conditional Access
Microsoft Entra Conditional Access allows administrators to define policies that evaluate conditions (like device state, location, user risk) and enforce specific access controls (like MFA, blocking access) in real-time. This perfectly matches the requirement for granular control based on device state.
Why the other options are wrong
- B. Microsoft Entra Access Reviews are for periodic re-certification of access rights, not real-time access control policies.
- C. Microsoft Entra PIM manages just-in-time access for privileged roles, not general user access based on device management status.
- D. Microsoft Entra Identity Protection focuses on risk detection and remediation, not granular access policy enforcement based on device state.
Microsoft Entra Conditional Access
A Microsoft Entra ID feature that enables you to enforce policies based on specific conditions to control access to resources.
- Uses 'If-Then' statements (If a user wants to access a resource, then they must complete an action)
- Conditions can include user, group, location, device state, application, sign-in risk
- Controls include block access, require MFA, require compliant device, require hybrid joined device, require approved client app
Memory trick: Conditions are the traffic lights for access.