nerdexam
Microsoft

SC-300 · Question #87

Hotspot Question Your company has a Microsoft 365 tenant. All users have computers that run Windows 10 and are joined to the Azure Active Directory (Azure AD) tenant. The company subscribes to a third

The correct answer is Ensure that the users can connect to Service1 without being prompted for authentication.: An enterprise application in Azure AD; Ensure that the users can access Service1 only from the Azure AD-joined computers.: A conditional access policy. This question tests knowledge of Azure AD SSO configuration and Conditional Access policies to enable seamless authentication to a third-party OAuth-based SaaS application while restricting access to Azure AD-joined devices only.

Submitted by haru.x· Mar 6, 2026Implement access management for apps

Question

Hotspot Question Your company has a Microsoft 365 tenant. All users have computers that run Windows 10 and are joined to the Azure Active Directory (Azure AD) tenant. The company subscribes to a third-party cloud service named Service1. Service1 supports Azure AD authentication and authorization based on OAuth. Service1 is published to the Azure AD gallery. You need to recommend a solution to ensure that the users can connect to Service1 without being prompted for authentication. The solution must ensure that the users can access Service1 only from Azure AD-joined computers. The solution must minimize administrative effort. What should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Answer Area

  • Ensure that the users can connect to Service1 without being prompted for authentication.An enterprise application in Azure AD
    An app registration in Azure ADAzure AD Application ProxyAn enterprise application in Azure ADA managed identity in Azure AD
  • Ensure that the users can access Service1 only from the Azure AD-joined computers.A conditional access policy
    Azure AD Application ProxyA compliance policyA conditional access policyAn OAuth policy

Explanation

This question tests knowledge of Azure AD SSO configuration and Conditional Access policies to enable seamless authentication to a third-party OAuth-based SaaS application while restricting access to Azure AD-joined devices only.

Approach. For enabling SSO without authentication prompts, you should configure Federated Single Sign-On (SSO) using OAuth/OIDC in Azure AD Enterprise Applications for Service1, since it supports Azure AD authentication and is already in the gallery - this minimizes administrative effort. For restricting access to only Azure AD-joined computers, you should create a Conditional Access policy that requires the device to be 'Azure AD joined' (compliant or hybrid joined device filter), specifically using the 'Require device to be marked as compliant' or 'Require Azure AD joined device' grant control. This combination ensures seamless SSO via federated authentication and enforces device-based access control without additional infrastructure.

Concept tested. Azure AD Enterprise Application SSO configuration (OAuth/OIDC federated SSO for gallery apps) and Azure AD Conditional Access policies with device compliance/join state requirements to restrict access to Azure AD-joined computers while minimizing administrative overhead.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso and https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant

Topics

#SSO#OAuth#enterprise applications#conditional access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice