Scenarios supported by compliant network check in Global Secure Access

SC-100 By islever Editorial Last updated Sep 25, 2026

Evaluate solutions for network security and Security Service Edge (SSE)

Short answer

AD Compliant network check supports cloud apps like the third-party SaaS app and on-prem apps via app proxy; it does not apply to source computers or CAE.

Question

Your company has a main office and a branch office. The main office contains 20 on-premises servers that run Windows Server and host apps that are published by using Microsoft Entra application proxy. The main office contains 500 on-premises computers that run Windows 11. The branch office contains 100 on-premises computers that run Windows 11. All the main office computers are enrolled in Microsoft Intune. The branch office computers are NOT enrolled in Intune. You have a Microsoft 365 ES subscription. You have a Microsoft Entra tenant. You have a third-party software as a service (SaaS) app that is registered in the Microsoft Entra tenant. You plan to implement Global Secure Access. You are evaluating the use of compliant network check and Conditional Access. Which two scenarios are supported by compliant network check? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point

connections to the third-party SaaS app Correct Answer
connections from the branch office computers
Continuous Access Evaluation for Microsoft Exchange Online
connections to the on-premises apps Correct Answer

Key Takeaways

Compliant network check requires the destination app to be Entra ID-integrated (cloud app) or app-proxy-published (on-prem); branch-office computers and CAE for Exchange are not compliant-network-check scenarios.

Compliant network check in Microsoft Entra Global Secure Access is supported for connections to Entra ID cloud apps such as a third-party SaaS app registered in Entra and for on-premises apps published through the Entra application proxy; it is not a per-computer or CAE feature.

Common mistake: Selecting connections from branch-office computers (B) or CAE for Exchange Online (C) — compliant network check evaluates destination-app trust, not source computers, and is separate from Continuous Access Evaluation.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra Global Secure Access compliant network check works for apps that are Entra ID-integrated cloud apps (such as the third-party SaaS app registered in Entra, option A) and for on-premises apps published through the Entra application proxy (option D). It lets Conditional Access trust that the connection originated from a compliant network.

Why the Other Options Are Wrong

Connections from the branch-office computers (B) are about the source device, not a destination app supported by compliant network check, and those computers are not even Intune-enrolled. Continuous Access Evaluation for Exchange Online (C) is a separate real-time reevaluation feature, not a compliant-network-check scenario.

Community Comment Notes

The community favored A and D (55 votes). Comments cite the compliant-network documentation confirming it covers cloud apps and app-proxy-published on-prem apps; a minority (AD 45) included CAE, which is a distinct feature.

Official Reference

https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network

This link opens the official vendor documentation in a new tab.

Community Votes

55%

45%

55% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

sweetykaur 👍 4

A. connections to the third-party SaaS app D. connections to the on-premises apps Compliant network check ensures that devices meet specific security requirements before allowing connections to certain applications. This helps enforce security policies and control access to both third-party SaaS apps and on-premises applications.
424ede1 👍 2

Browse to Global Secure Access > Settings > Session management > Adaptive access. Select the toggle to Enable CA Signaling for Entra ID (covering all cloud apps). This will automatically enable CAE signaling for Office 365. If your organization is enrolling devices into Microsoft Intune, it is recommended to exclude the applications Microsoft Intune Enrollment and Microsoft Intune from your Conditional Access policy to avoid a circular dependency. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network#enable-global-secure-access-signaling-for-conditional-access
676ae1a 👍 2

Conexiones a la aplicación SaaS de terceros: Permite garantizar que solo las conexiones desde redes seguras puedan acceder a la aplicación SaaS, mejorando la seguridad general. Conexiones a las aplicaciones locales: Ayuda a asegurar que solo usuarios y dispositivos en ubicaciones seguras puedan acceder a las aplicaciones locales publicadas mediante el proxy de aplicación.
reyreyg 👍 2

Answer correct https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network
SMHcalicut 👍 1

Continuous Access Evaluation (CAE) is a feature that provides real-time access decisions based on user and device state changes. While CAE enhances security, it is not directly related to compliant network checks

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide