SC-100 Certification Practice Question #89

Question

You have a Microsoft Entra tenant. The tenant contains 500 Windows devices that have the Global Secure Access client deployed.

You have a third-party software as a service (SaaS) app named App1.

You plan to implement Global Secure Access to manage access to App1.

You need to recommend a solution to manage connections to App1. The solution must ensure that users authenticate by using their Microsoft Entra credentials before they can connect to App1.

What should you include the recommendation?

Accepted Answer

The requirement is to manage connections to a third-party SaaS app (App1) and ensure users authenticate with their Microsoft Entra credentials before connecting. Creating a Global Secure Access app makes App1 an Entra enterprise application, which is the object that lets you assign users/groups and attach Conditional Access policies — the mechanism that forces Entra authentication ahead of access. A traffic forwarding profile (option C) is a prerequisite for routing traffic to the GSA edge but is a transport setting; it does not, on its own, establish per-app identity-aware authorization. Suggested Answer and the dominant 8-vote consensus (with a 5-👍 Highly Voted comment) both choose A, and MS Learn confirms the GSA/enterprise-app is what carries user assignment plus Conditional Access. Confidence is held at 80 because there is a genuine, reasoned community split toward C — those commenters are correct that an internet-access profile is needed to onboard SaaS traffic, but it is the GSA app, not the profile, that satisfies the "authenticate with Entra credentials before connecting" requirement.

More SC-100 practice questions