AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID B2B to collaborate with external vendors. They want to enforce that external users must use multi-factor authentication (MFA) and access company resources only from compliant devices (e.g., managed by Intune). They also want to require a session timeout of 1 hour. Which combination of Microsoft Entra ID features should they use?
⚠ Common exam trap
A common mix-up: candidates confuse Conditional Access session controls with token lifetime policies or think that Identity Protection alone can enforce device compliance, but only Conditional Access policies can combine MFA, device compliance, and session timeout in a single policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
B
It combines Conditional Access policies with session controls to enforce MFA, device compliance (via Intune), and a 1-hour session timeout. Conditional Access policies evaluate sign-in risk and require MFA and compliant devices, while the session control 'Sign-in frequency' can be set to 1 hour to enforce reauthentication. This meets all three requirements without relying on deprecated or separate features.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A
Why it's wrong here
Microsoft Entra ID Identity Protection does not itself enforce device compliance or session timeout controls. It focuses on detecting and responding to identity risk signals, such as leaked credentials or sign-ins from anonymous IP addresses, and can impose risk-based policies like requiring MFA when risk is elevated. However, requiring a device to be marked as compliant or setting sign-in frequency are Conditional Access capabilities, not Identity Protection features. Therefore, while Identity Protection can be used alongside Conditional Access, it is not the correct service to meet all three requirements.
- ✓
B
Why this is correct
Microsoft Entra ID Conditional Access is the comprehensive policy engine that can enforce all the stated requirements during sign-in. A Conditional Access policy can require multi-factor authentication for external B2B users, require the device to be marked as compliant by integrating with Intune, and apply session controls that set sign-in frequency to force periodic reauthentication. These policies can be targeted to guest and external users specifically, making Conditional Access the right tool for controlling access in B2B collaboration scenarios.
- ✗
C
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to administrative roles through time-bound activation and approval workflows. It does not enforce authentication conditions like MFA, device compliance, or session timeout for end users or B2B collaboration participants. PIM is concerned with who can elevate to a privileged role and for how long, not with the conditions under which a user signs in to access resources.
- ✗
D
Why it's wrong here
Microsoft Entra ID Access Reviews provide a periodic, human-driven process to certify whether a user still needs access, and administrators can then revoke stale or unnecessary permissions. However, Access Reviews are not evaluated at sign-in time; they do not apply MFA, device compliance, or session-based restrictions. They are an identity governance tool that runs on a schedule, whereas Conditional Access enforces real-time controls during authentication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.