Objective and prerequisite
Use the identity distinction introduced in the planned identity unit: proving an identity and permitting an action are different questions. This lesson adds two further distinctions. A policy can set conditions on an access request, and a role grants permissions within a stated scope. Do not combine those into one vague decision called access. At the end, explain which requirement is being changed, which resource a role concerns, and which fact remains unknown. The examples are conceptual; no account, policy, or resource is created.
Conditions and permissions answer different questions
Microsoft Entra Conditional Access combines signals into organizational policy decisions. A simple policy can require an action such as MFA when its conditions apply. The documented evaluation occurs after first-factor authentication; that does not mean the first successful identity check satisfies every further requirement. In an Azure-resource case, separately identify the permission to perform the requested resource action. Azure roles govern Azure resources, while Entra roles govern directory resources. By default the scopes do not simply extend across both systems. A familiar administrative title therefore is not enough evidence of permission on an unrelated target.
Worked example
Fictional teaching case: an arts council writes requirements for two jobs. A help team administers directory user records. A publishing team manages the council’s Azure-hosted catalog resources. The council also wants a stated device/sign-in condition to trigger MFA. First write the jobs and targets in separate rows: directory administration, catalog-resource actions, and the conditional sign-in requirement. The directory row belongs to the Entra role scope; the Azure-resource row needs its relevant resource authorization scope. The signal-based MFA requirement is a Conditional Access task, rather than a new list of catalog actions. The conclusion is three requirements to keep distinct, not a recommendation to grant one broad identity all three. Check the result by changing only the requested action: a permission concerning user records does not thereby become catalog-resource administration.
Contrast and boundary
Now imagine the council changes its requirement from “require an additional authentication factor under these conditions” to “allow an additional catalog-management action.” Reusing the same answer would ignore the changed task: the latter is an action-permission question. Conversely, an existing role can be correct for an action while a separate sign-in condition remains unmet. MFA is evidence about authentication factors, not a role assignment. These distinctions do not imply every application uses the same permission system; keep the case’s named target and authorization model. This is not an elevation procedure, licensing guide, or complete security design.
Transfer check
Try before reading the check basis: a fictional resource engineer has the stated permission for an Azure target and has completed first-factor authentication. The scenario explicitly says an applicable Conditional Access rule still requires MFA, which has not been completed. Does the resource-role assignment by itself satisfy the remaining requirement? Check basis: no. The role supplies the stated action permission, while the expressly pending authentication condition is a different requirement. Do not infer that the role is wrong merely because another condition remains. Then attempt the separate formal tasks sc900-q-017 and sc900-q-018, and retrieve cards sc900-card-13 through sc900-card-15. Explain the relevant condition and scope before looking at feedback.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
Authentication vs. authorization - Microsoft identity platform | Microsoft LearnMicrosoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Entra ID | Microsoft LearnMicrosoft Entra multifactor authentication overview - Microsoft Entra ID | Microsoft LearnAzure roles, Microsoft Entra roles, and classic subscription administrator roles | Microsoft Learn