Describe the capabilities of Microsoft Entra
Conditional Access and Microsoft Entra Roles
CoreDistinguish signal-driven access decisions from role-based permission assignment.
Aligned to the SC-900 skills measured as of July 28, 2026; product behavior verified September 10, 2026.
Why this matters
Secure access requires both conditions for allowing a session and a clear definition of what the identity may do after access is granted.
Must Know
- Conditional Access is Microsoft's Zero Trust policy engine for evaluating signals and applying access controls.
- A Conditional Access policy expresses if-then logic: if a user or workload, target resource, location, device, application, or risk condition matches, then enforce a control such as MFA, a compliant device, limited session, or block.
- Microsoft Entra roles grant permissions to manage Microsoft Entra resources, such as users, groups, applications, and directory settings.
- Role-based access control assigns permissions through roles at a defined scope and supports least privilege.
- Conditional Access influences whether and under what conditions access proceeds; a role defines allowed administrative actions.
Compare and Distinguish
- Conditional Access vs MFA: Conditional Access can require MFA based on signals; MFA is the verification method.
- Conditional Access vs Microsoft Entra role: session admission and requirements versus administrative permissions.
- Microsoft Entra roles vs Azure RBAC roles: permissions for Entra resources versus permissions for Azure resources.
- Role assignment vs identity: a principal receives a role; creating the principal grants no role automatically.
Scenario examples
- A policy requires MFA when a user signs in from an unfamiliar location.
- A help desk operator receives a narrowly scoped Microsoft Entra role instead of a broad global role.
- A user passes Conditional Access but still cannot change directory settings because no suitable role grants that action.
Exam traps
- Conditional Access is not a blanket permission grant.
- MFA is not an authorization role.
- Microsoft Entra roles and Azure RBAC roles govern different resource families even though both use roles.
- A broad role is not preferable merely because it avoids future access requests.
Key takeaways
- Conditional Access evaluates context and enforces session controls.
- Roles grant permissions at a scope.
- Keep Microsoft Entra roles separate from Azure resource roles.
- Use least privilege for role selection.
Ready for the quiz?
- Which control can require MFA for risky context?
- What grants permission to manage Entra users?
- Why can a permitted sign-in still lack an admin action?
Related objectives
- D2.3.S1 — Describe Microsoft Entra Conditional Access
- D2.3.S2 — Describe Microsoft Entra roles and role-based access control (RBAC)