Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraHard
A global company has a strict compliance requirement to ensure that all users accessing corporate applications from unmanaged devices are always prompted for multi-factor authentication (MFA) and have their session restricted to prevent data download. Additionally, users accessing from managed devices within the corporate network should have a seamless sign-on experience without MFA. Which Microsoft Entra capability can provide this level of granular control?
- AMicrosoft Entra Identity Protection
- BMicrosoft Entra Privileged Identity Management
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra Connect
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Conditional Access
Microsoft Entra Conditional Access is designed to enforce policies based on specific conditions such as user location, device state (managed/unmanaged), and application. It can require MFA, block access, or apply session controls like preventing data download, precisely meeting the granular control and varied requirements of the scenario.
Why the other options are wrong
- A. Identity Protection focuses on identity risk detection, not granular access policy based on device management or network location.
- B. PIM manages privileged role activation, not general user access policies based on device/location.
- D. Connect synchronizes directories, it doesn't enforce access policies.
Microsoft Entra Conditional Access
A policy engine that evaluates multiple signals (user, device, location, app, risk) to make real-time access decisions and enforce organizational policies, such as requiring MFA or blocking access.
- Offers granular control over access to applications and data.
- Integrates with Microsoft Intune for device compliance data.
- Allows session controls like 'Use app enforced restrictions' or 'Require persistent browser session'.
- Supports various conditions, including user, group, cloud app, device platform, device state, location, and sign-in risk.
Memory trick: Entra's Conditional Access: the gatekeeper with rules for every access.