AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID and wants to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications. However, they want to exclude users when connecting from the corporate office IP range and only allow access from devices that are compliant with Intune policies. Which Microsoft Entra ID feature should they use to create this policy?
⚠ Common exam trap
A common mix-up: candidates confuse Conditional Access with Identity Protection, thinking risk-based policies can enforce location or device compliance, but Identity Protection only triggers actions based on risk scores, not static conditions like IP ranges or Intune compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access
C is correct because Microsoft Entra ID Conditional Access is the feature specifically designed to enforce granular access policies based on conditions such as user, location, device compliance, and application sensitivity. By configuring a Conditional Access policy, you can require MFA for sensitive applications, exclude the corporate office IP range, and restrict access to Intune-compliant devices, all within a single policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Identity Protection
Why it's wrong here
Microsoft Entra ID Identity Protection is a risk-based detection engine that evaluates sign-in risk and user risk using signals like anonymous IP addresses, atypical travel, or leaked credentials. While it can automatically require MFA in response to detected risk, it cannot enforce MFA based on static, administratively defined conditions such as excluding your corporate IP range or requiring a specific device compliance status. The described scenario is a deterministic access policy, not a risk-based response, so Identity Protection is not the correct tool.
- ✗
Microsoft Entra ID Privileged Identity Management
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) is designed for just-in-time, time-bound, and approval-based activation of elevated roles such as Global Administrator or Role-Based Access Control assignments. It manages the lifecycle of privileged role assignments and provides alerts and access reviews for those roles, but it does not apply authentication requirements to end-user access of applications. Requiring MFA for general sensitive app access while excluding certain networks is strictly an authentication policy, which falls outside PIM's scope.
- ✓
Microsoft Entra ID Conditional Access
Why this is correct
Conditional Access policies allow you to specify conditions (e.g., IP location, device compliance) and controls (e.g., require MFA, block access). This enables the described scenario: require MFA for sensitive apps, but exclude corporate IP range and require compliant device.
- ✗
Microsoft Entra ID Identity Governance
Why it's wrong here
Microsoft Entra ID Identity Governance focuses on access lifecycle management through entitlement management, access certifications, and access reviews to answer 'who should have access and for how long.' It does not evaluate authentication context in real time; it is not an authentication policy enforcement point. The scenario mandates MFA and device compliance at sign-in time, which is a session control condition, not an access-governance decision about resource membership or ongoing access eligibility.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.