Manage identity, access, and governance

Conditional Access Signals, Decisions and Session Controls

Conditional Access is Microsoft Entra ID's if-then policy engine. It evaluates a set of signals about a sign-in attempt, applies a decision that either blocks or grants access, and can then constrain the resulting session. Knowing which piece belongs where is the fastest way to eliminate wrong answers on scenario questions.

Exam tip. If a scenario describes something happening only after sign-in succeeds, such as limiting downloads or forcing frequent re-authentication, that is a session control, not a grant control. Read the verb carefully; 'require' usually signals a grant control, 'restrict' or 'limit during the session' usually signals a session control.

Privileged Identity Management: Eligible vs Active Assignments

Microsoft Entra Privileged Identity Management (PIM) exists to remove standing privileged access. Instead of a user holding an administrator role permanently, PIM makes the role eligible, and the user activates it only when needed, for a limited time.

Exam tip. A question describing standing, always-on administrator access as a finding to fix is almost always solved by converting that assignment from active to eligible in PIM, not by removing the role entirely.

Protecting Key Vault: Access, Network and Detection

SC-500 treats Key Vault as three separate decisions that candidates often collapse into one: who may call the vault, where they may call it from, and how you find out when something unusual happens. Getting the access model right does nothing about a leaked credential used from the right network, and a firewall does nothing about an insider. The exam tests whether you reach for all three.

Exam tip. A stem asking to be alerted without writing detection logic is pointing at a Defender plan, not at diagnostic settings.

Enforcing Governance: Policy, RBAC and the Order They Apply

Governance questions on SC-500 usually give you a requirement and four mechanisms, and the discriminator is whether the mechanism can actually prevent the thing or only report it. Azure Policy can deny at the control plane. RBAC decides who may ask. Locks stop deletion. Defender for Cloud measures. Only some of those stop a resource existing in a bad state.

Exam tip. Prefer a default that makes the wrong state unreachable over a rule that detects it afterwards, unless the stem explicitly rules the default out.

1. Hollowmere Underwriters wants employees to satisfy multi-factor authentication whenever they sign in to the Azure portal from outside the corporate office IP range, while allowing seamless sign-in from trusted office locations. Which approach should the security team configure?

• A. Enable Microsoft Entra security defaults for the entire tenant
• B. Create a Conditional Access policy that targets all locations except a named trusted location and requires multi-factor authenticationcorrect
• C. Configure Privileged Identity Management for the affected users
• D. Enable Microsoft Entra Password Protection with a custom banned password list

Conditional Access lets you scope a policy by named location, excluding trusted office IP ranges, and require MFA only for sign ins outside that boundary. Security defaults apply MFA uniformly to all users everywhere and cannot exclude trusted locations. PIM manages privileged role activation, not general sign in conditions. Password Protection blocks weak passwords, it does not enforce MFA.

2. An administrator at Everdale Distribution disables a compromised user's account, but the user's existing access token remains valid for up to an hour, allowing continued access to resources until the token expires. Which feature should be enabled so that critical events like account disablement revoke access in near real time instead of waiting for token expiration?

• A. A stricter Conditional Access sign-in frequency setting
• B. Continuous Access Evaluationcorrect
• C. A recurring access review for the affected resource
• D. Identity Protection user risk policy

Continuous Access Evaluation subscribes to critical events such as account disablement, password reset, and location change, revoking tokens near real time instead of waiting for expiration. Sign-in frequency only affects how often reauthentication is required going forward, and risk policies act at sign-in time, not against a live session.