A company uses Microsoft Entra ID and wants to enforce that all users must use multi-factor authentication (MFA) when accessing sensitive applications. However, they want to exclude users when connecting from the corporate office IP range and only allow access from devices that are compliant with Intune policies. Which Microsoft Entra ID feature should they use to create this policy?

Microsoft Entra ID Identity Protection

Identity Protection focuses on detecting risky sign-ins and user behavior, not on enforcing MFA based on location and device compliance. It can require MFA on risky sign-ins but not with custom location exclusions.

Microsoft Entra ID Privileged Identity Management

PIM is used for managing, controlling, and monitoring access to privileged roles in Microsoft Entra ID. It does not handle MFA policies for general access to applications.

Microsoft Entra ID Identity Governance

Identity Governance includes features like access reviews and entitlement management, which are used for managing access lifecycles, not for enforcing MFA policies.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Conditional Access — Microsoft Entra ID Conditional Access allows you to create policies that enforce access conditions. You can set conditions such as location (IP range) and device compliance (managed devices), and then require MFA or block access. Microsoft Entra ID Identity Protection deals with risk-based policies. Microsoft Entra ID Privileged Identity Management (PIM) is for just-in-time privileged access. Microsoft Entra ID Identity Governance includes access reviews and entitlement management. Therefore, Conditional Access is the correct feature.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.