Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A security administrator needs to ensure that only devices that meet specific compliance standards (e.g., up-to-date antivirus, OS version) can access sensitive corporate resources in Microsoft Entra ID. Which Microsoft Entra capability allows the administrator to define these device-specific requirements and enforce them?
- AMicrosoft Entra Identity Protection
- BMicrosoft Entra Privileged Identity Management (PIM)
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra Access Reviews
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Conditional Access
Microsoft Entra Conditional Access allows administrators to configure policies that evaluate specific conditions, such as device state, location, or user risk, and then enforce access controls like blocking access or requiring MFA.
Why the other options are wrong
- A. Identity Protection focuses on user and sign-in risks, not device compliance.
- B. PIM manages privileged role assignments, not device-based access conditions.
- D. Access Reviews ensure continued need for access, not real-time device compliance.
Microsoft Entra Conditional Access
A powerful policy engine that evaluates conditions and enforces automated access decisions for cloud apps.
- Combines 'If-Then' statements to control access.
- Conditions include user, device, location, application, sign-in risk.
- Controls include block access, require MFA, require compliant device.
Memory trick: Conditional Access is the traffic cop for your cloud apps: 'If this, then that'.