A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?

A

Microsoft Entra ID Identity Protection provides risk-based policies (e.g., sign-in risk) but does not directly enforce device compliance or session timeout controls.

C

Privileged Identity Management (PIM) is for managing elevated roles, not for enforcing MFA or device compliance for external B2B users.

D

Microsoft Entra ID Access Reviews allow periodic review of access, but they do not enforce real-time conditions like MFA or device compliance during sign-in.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: B — Microsoft Entra ID Conditional Access provides a unified policy engine that can enforce MFA, require device compliance, and set session controls (e.g., sign-in frequency). Device compliance can be verified through integration with Microsoft Intune. Microsoft Entra ID Identity Protection focuses on risk detection, not device compliance. Privileged Identity Management (PIM) is for just-in-time privileged access. Access Reviews help with periodic access certification but do not enforce conditions in real-time.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.