SC-300 Certification Practice Question #133

Question

You have an Azure AD tenant named contoso.com that contains the resources shown in the following table.

You create a user named Admin1.

You need to ensure that Admin1 can enable Security defaults for contoso.com.

What should you do first?

Accepted Answer

Security defaults and Conditional Access are mutually exclusive — Microsoft Learn states an organization implementing Conditional Access policies *must disable* security defaults, and conversely you cannot enable security defaults while a Conditional Access policy (CAPolicy1) is active. The blocker to enabling Security defaults for contoso.com is therefore the existing Conditional Access policy, so the first action is to delete CAPolicy1. Deleting an entitlement/app package (A), assigning the Authentication Administrator role (C — wrong role; the role to manage security defaults is Conditional Access Administrator / Security Administrator), or configuring Identity Governance (D) do nothing to remove the CA-policy conflict. Suggested Answer, an 8-vote community majority, and Microsoft Learn all align on B.

More SC-300 practice questions