Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A multinational corporation uses Microsoft Entra ID and wants to ensure that all access to sensitive applications is conditional based on factors such as user location, device compliance, and sign-in risk. If a user attempts to access a sensitive application from an untrusted location or an uncompliant device, access should be blocked or require multifactor authentication. Which Microsoft Entra capability allows for this granular access control?
- AMicrosoft Entra Domain Services
- BMicrosoft Entra B2B Collaboration
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra PIM
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Conditional Access
Microsoft Entra Conditional Access policies allow organizations to enforce controls like multifactor authentication, device compliance, or sign-in risk checks based on specific conditions, ensuring that access to sensitive resources is granted only when appropriate. This directly addresses the requirement for granular, conditional access.
Why the other options are wrong
- A. Microsoft Entra Domain Services provides managed domain controllers for legacy applications, unrelated to conditional access policies.
- B. Microsoft Entra B2B Collaboration is for inviting external users, not for enforcing granular access policies for internal users.
- D. Microsoft Entra PIM manages just-in-time access for privileged roles, not general conditional access to applications.
Microsoft Entra Conditional Access
A Microsoft Entra ID capability that enables organizations to enforce policies based on specific conditions, such as user location, device compliance, and sign-in risk, to control access to resources.
- Enforces policies based on conditions (who, what, where, how)
- Can block access or require additional authentication
- Core component of Zero Trust security
Memory trick: Conditional Access: 'If this, then that' for security.