Using Entra Internet Access to restrict users to authenticating only to their tenant

SC-100 By islever Editorial Last updated

Evaluate solutions for network security and Security Service Edge (SSE)

Short answer

C Entra Internet Access (Microsoft 365 profile) enforces tenant restrictions so users authenticate only to contoso.com.

Question

You have a Microsoft 365 tenant named contoso.com. You need to ensure that users can authenticate only to contoso.com. The solution must meet the following requirements: • Prevent the users from authenticating to other Microsoft 365 tenants. • Minimize administrative effort. What should you use?
  1. Microsoft Entra Private Access
  2. Microsoft Defender for Endpoint
  3. Microsoft Entra Internet Access Correct Answer
  4. Microsoft Defender for Cloud Apps

Key Takeaways

Entra Internet Access with the Microsoft 365 profile enforces tenant restrictions so users cannot authenticate to other tenants; Private Access is for private apps, Defender for Endpoint is endpoint protection, and Defender for Cloud Apps governs SaaS usage.

To ensure users authenticate only to contoso.com and are prevented from authenticating to other Microsoft 365 tenants with minimal effort, use Microsoft Entra Internet Access (the Microsoft 365 profile) which enforces tenant restrictions for internet-bound M365 traffic.

Common mistake: Choosing Entra Private Access (A) — that secures access to private/internal apps, not the restriction of user authentication to a specific M365 tenant.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra Internet Access provides the Microsoft 365 profile and enforces tenant restrictions for internet-bound Microsoft 365 traffic, ensuring users authenticate only to contoso.com and cannot sign in to other tenants, with minimal administrative effort.

Why the Other Options Are Wrong

Entra Private Access (A) secures access to private/internal applications, not authentication restrictions to the M365 tenant. Defender for Endpoint (B) is endpoint threat protection. Defender for Cloud Apps (D) discovers and controls SaaS app usage but does not enforce tenant-restricted authentication.

Community Comment Notes

The community favored C (80 votes). Comments confirm Entra Internet Access (with the M365 profile) is the SSE product that enforces tenant restrictions; a minority (A, 20 votes) confused Private Access with Internet Access.

Official Reference

https://learn.microsoft.com/en-us/entra/global-secure-access/concept-internet-access

This link opens the official vendor documentation in a new tab.

Community Votes

C
80%
A
20%

80% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Elisa2021 👍 2 Answered C
    C -is designed to provide secure access to private applications and resources, typically replacing traditional VPNs with a Zero Trust Network Access (ZTNA) solution12. It focuses on securing access to internal resources from any device and network, which is not directly related to restricting user authentication to a specific Microsoft 365 tenant.
  2. Er_01 👍 1 Answered A
    A - It appears you can do this with both Private and Public Access, but the Private way is easier to do.
  3. Saynot 👍 1 Answered C
    Not A, couse is more releated to access private apps or resources
  4. 424ede1 👍 1 Answered C
    Entra Internet Access internet access is for outgoing

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide