Microsoft Entra Private Access Device Requirements

SC-300 By islever Editorial Last updated

Implement Global Secure Access

Short answer

B Only Device2 (Microsoft Entra joined Windows device) meets the requirements for Microsoft Entra Private Access.

Question

You have a Microsoft Entra tenant that contains the devices shown in the following table.
Exhibit: Microsoft Entra Private Access Device Requirements
You plan to configure Microsoft Entra Private Access.
You deploy the Global Secure Access client to compatible devices.
From which devices can you use Private Access?
  1. Device1 only
  2. Device2 only Correct Answer
  3. Device2 and Device4 only
  4. Device1, Device2, and Device3 only
  5. Device1, Device2, Device3, and Device4

Key Takeaways

Tests the distinction between Microsoft Entra Joined and Registered device requirements for Global Secure Access clients, with the trap being the inclusion of registered or Android devices.

Determines which devices can use Microsoft Entra Private Access based on join type and platform. Establishes that only Microsoft Entra joined Windows devices are supported for this specific feature.

Common mistake: Most common wrong answer is E (All devices) because learners assume any registered device or mobile platform supports the client, missing the strict 'Joined' requirement for Private Access.

Expert Analysis

Why the Answer Is Correct

The question asks about Microsoft Entra Private Access, a component of Global Secure Access. According to official documentation, the Global Secure Access client for Windows requires the device to be either Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered devices do not meet this requirement for Private Access. Therefore, Device2 (Windows 10, Microsoft Entra joined) is the only valid option among the choices provided.

Why the Other Options Are Wrong

Device1 and Device3 are Microsoft Entra registered, which is insufficient for Private Access; they lack the full identity integration of a joined device. Device4 is an Android device. While the Global Secure Access agent exists for Android, Microsoft Entra Private Access specifically relies on deep OS integration typically associated with the Windows client for secure tunneling to private resources in this context, and many exam questions distinguish strictly between 'Joined' support and 'Registered/Mobile' support. Even if Android were considered, the combination in Option C includes it but excludes the clearly correct Device2-only scenario if B is the intended single best fit for 'Private Access' as distinct from general GSA.

Community Comment Notes

Several users initially voted for E, citing broad compatibility of the Global Secure Access agent across platforms. However, later comments and links to Microsoft Learn articles clarify that for Private Access (ZTNA), the Windows client specifically mandates a Joined state. As one user noted, "Android devices are not supported for Private Access" in the strict sense required by the exam's distinction, or at least are not the primary target compared to Joined Windows devices. The consensus shifted towards B after reviewing the official installation prerequisites for Windows devices.

Official Reference

https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always differentiate between general Microsoft Entra ID capabilities and specific features like Private Access. For Private Access, remember that 'Joined' is the key keyword for Windows devices, whereas 'Registered' is often a distractor for features requiring deeper OS trust.

Frequently Asked Questions

Why are Microsoft Entra registered devices not supported for Private Access?

Private Access requires deep OS integration and identity enforcement that is primarily available on Microsoft Entra Joined devices. Registered devices lack this level of management and trust.

Does Android support Microsoft Entra Private Access?

While the Global Secure Access agent runs on Android, the exam scenario typically distinguishes Private Access as a feature heavily reliant on the Windows Joined client experience for ZTNA. In this specific question context, Android is excluded.

More SC-300 FAQ →

Community Votes

B
72%
E
28%

72% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. 9H3zmT6 👍 14 Answered C
    The requirements vary depending on the platform OS. For WINDOWS, the device must be either Microsoft Entra joined or Microsoft Entra hybrid joined. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client For ANDROID, the device must be Microsoft Entra registered. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-android-client?tabs=device-administrator
  2. Btn26 👍 10 Answered E
    EPA can be used with both Azure AD Joined and Azure AD Registered devices. The Global Secure Access client can be deployed on various platforms, including Windows, macOS, iOS, Android, and Linux. In this scenario: Device1 (Windows 11, Microsoft Entra registered) Device2 (Windows 10, Microsoft Entra joined) Device3 (Windows 10, Microsoft Entra registered) Device4 (Android, Microsoft Entra registered) All these devices are either Azure AD Joined or Azure AD Registered and can have the Global Secure Access client deployed. Therefore, all four devices can potentially use Private Access. Therefore, the correct answer is E. Device1, Device2, Device3, and Device4.
  3. Btn26 👍 6
    Changing answer to B. Microsoft Entra Private Access compatibility requires: Global Secure Access Client compatibility. Join type and platform support: Windows devices must be Microsoft Entra joined (not just registered). Android devices are not supported for Private Access
  4. barlar 👍 4 Answered B
    Isn't B a better option? for Android though it seems just registered is enough but there is more to it, the question doesn't say anything about how its managed or if the authenticator app is intalled. *Android devices must be Microsoft Entra registered devices. -->Devices not managed by your organization must have the Microsoft Authenticator app must be installed. -->Devices not managed through Intune must have the Company Portal app installed. -->Device enrollment is required for Intune device compliance policies to be enforced.
  5. Giuseppe_Geraci 👍 2 Answered B
    Microsoft Entra Private Access (formerly part of Global Secure Access in Microsoft Entra) is a Zero Trust Network Access (ZTNA) solution that allows secure access to private resources (e.g., internal apps). To use Microsoft Entra Private Access, devices must meet the following requirement: Be Microsoft Entra joined (not just registered).
Show 11 more comments
  1. anonymousarpanch 👍 2 Answered B
    answer is B. check this link... https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client. For GSA you need Microsoft Entra joined or MS entra hybrid JOINED devices. Microsoft entra registered devices are not supported.
  2. 93831b0 👍 2 Answered E
    Don't know how old is this question but the supported devices has been extended: https://learn.microsoft.com/en-us/entra/global-secure-access/concept-clients
  3. c8754bf 👍 2 Answered B
    only join https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client
  4. AcTiVeGrEnAdE 👍 2
    This is the correct answer
  5. Pastusz 👍 1 Answered D
    Device1 Windows 11 Microsoft Entra registered ✅ Yes Supported OS and join type Device2 Windows 10 Microsoft Entra joined ✅ Yes Supported OS and join type Device3 Windows 10 Microsoft Entra registered ✅ Yes Supported OS and join type Device4 Android Microsoft Entra registered ❌ No Android not supported for GSA client
  6. hitten_za 👍 1 Answered E
    Agent is supported on Joined/Registered devices and on Windows, MacOS, Android and iOS https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client https://learn.microsoft.com/en-us/entra/global-secure-access/concept-clients
  7. AcTiVeGrEnAdE 👍 1 Answered B
    B is the answer. Per the prerequisites defined in the MS docs: A managed device joined to the onboarded tenant. The device must be either Microsoft Entra joined or Microsoft Entra hybrid joined. Microsoft Entra registered devices aren't supported.
  8. AcTiVeGrEnAdE 👍 1
    Actually I stand corrected, the answer is actually E. The question throws you for a loop with talking about deploying GSA. Regardless of GSA, registered and joined devices can both use Private Access.
  9. familiaosousa 👍 1 Answered E
    Embora limitado, como o foco é private access, todos é o correto. Todos os dispositivos conseguem usar Private Access Resposta correta: E. Dispositivo 1, 2, 3 e 4
  10. AcTiVeGrEnAdE 👍 1
    Thats just to use GSA which doesnt answer the question. Private access can be joined, hybrid joined or registered which is what the question asks. Answer is E.
  11. raduM 👍 1 Answered E
    now entra registered can be used

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide