SC-100 Certification Practice Question #236

Question

You have a Microsoft 365 E5 subscription.

You plan to deploy Global Secure Access universal tenant restrictions v2.

Which authentication plane resources and which data plane resources will be protected? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Universal tenant restrictions v2 provides authentication-plane protection for every application that authenticates with Microsoft Entra ID — including all Microsoft apps and third-party/partner apps using Entra ID for sign-in — so the authentication-plane row is "All Microsoft Entra ID integrated apps, including third-party apps" (high confidence, community-unanimous). The data-plane row is the contested one: the GSA "enforcement points" page scopes data-plane enforcement to Microsoft Graph, while the External ID tenant-restrictions-v2 supported-scenarios list states data-plane protection for "SharePoint Online, Exchange Online, and Microsoft Graph." Because the dropdown offers neither "Microsoft Graph" nor "SharePoint Online, Exchange Online, and Microsoft Graph," the closest correct option is "Microsoft SharePoint Online and Exchange Online only" — and "All Microsoft 365 apps" is explicitly broader than the documented scope (Luweho's highly-quoted comment makes this point). Confidence is held in the high-70s because the official option set does not cleanly match Microsoft's wording for the data plane (Graph is documented but not offered), and the community itself splits between SPO/EXO-only and "all M365 apps."

More SC-100 practice questions