Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraHard
A company requires that all employees accessing highly sensitive applications must use a device that is both compliant with corporate security policies (e.g., up-to-date antivirus, OS patches) AND located within an approved geographical region. If either condition is not met, access should be denied. Which Microsoft Entra capability integrates with device compliance and location data to enforce these granular access controls?
- AMicrosoft Entra Access Reviews
- BMicrosoft Entra Identity Protection
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra Application Proxy
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Conditional Access
Microsoft Entra Conditional Access allows organizations to enforce granular access controls based on various conditions, including device state (integrated with Microsoft Intune for compliance) and location. This enables the 'AND' logic required for both conditions to be met for access.
Why the other options are wrong
- A. Access Reviews focus on periodically verifying existing access, not enforcing real-time access policies based on device or location attributes.
- B. Identity Protection focuses on detecting identity risks, not enforcing access based on device compliance or specific locations.
- D. Application Proxy provides secure remote access to on-premises apps but does not enforce granular device compliance or location-based policies.
Microsoft Entra Conditional Access
A powerful policy engine in Microsoft Entra ID that allows organizations to enforce automated access decisions based on user, device, location, application, and real-time risk conditions.
- Enforces granular access control policies.
- Combines multiple conditions (user, device, location, app, risk).
- Integrates with device compliance solutions (e.g., Intune).
Memory trick: Conditional Access is the smart gatekeeper checking all your papers.