SC-100 Certification Practice Question #121

Question

You have a Microsoft Entra tenant and an Azure subscription.

You are evaluating the use of a risk-based Conditional Access policy to control the access of workload identities to resources.

To which type of identity should you apply the policy, and which signal source can you use as part of the policy? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

A risk-based Conditional Access policy for workload identities can only target **service principals** — Microsoft Learn states that policy applies to single-tenant service principals registered in the tenant and that **managed identities are not covered**, which eliminates both managed-identity options. The risk signal that feeds the policy condition comes from **Microsoft Entra ID Protection** (the service that detects risk for workload identities and surfaces "Risky workload identities"); Client app and Device platform are ordinary sign-in conditions, not the risk source. This matches the unanimous Highly Voted comment (7 👍).

More SC-100 practice questions