AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID (Microsoft Entra ID). They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but do not want MFA to be required for other applications like Office 365. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
Many exam-takers confuse Security defaults (which enforces MFA broadly) with Conditional Access (which provides granular application-specific control), leading them to choose Security defaults when the question explicitly requires selective enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access
Conditional Access in Microsoft Entra ID allows granular control over authentication requirements based on conditions such as application, user, location, or device state. By creating a Conditional Access policy targeting the Azure Portal application and requiring MFA, the company can enforce MFA specifically for Azure Portal access without affecting other applications like Office 365, which can be excluded from the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Security defaults
Why it's wrong here
Security defaults enable a tenant-wide baseline that forces MFA for every user and every cloud application, including the Azure portal but also all other apps. There is no way to scope or exclude specific applications, so it fails the requirement of limiting MFA to only the Azure portal. Moreover, enabling Security defaults is mutually exclusive with custom Conditional Access policies, so an organization needing granular per-app control would not use this option.
- ✓
Microsoft Entra ID Conditional Access
Why this is correct
Conditional Access lets an administrator create a policy that targets the 'Microsoft Azure Management' cloud app, which is the service principal behind the Azure portal, and applies the 'Require MFA' grant control to assigned users or groups. This scopes MFA enforcement to Azure portal sign-ins only, leaving other applications with their own separate access policies. It is the appropriate mechanism because it directly maps the exact resource (Azure portal) to the required control (MFA) while allowing granular exclusions and conditions.
- ✗
Microsoft Entra ID Identity Protection
Why it's wrong here
Microsoft Entra ID Identity Protection is a risk-detection engine that evaluates sign-in anomalies (e.g., anonymous IP addresses, atypical travel, or leaked credentials) and assigns a user or sign-in risk level. It cannot itself require MFA for a specific application; instead, its risk signals must be fed into a Conditional Access policy to trigger MFA as a grant control. Because the requirement is to enforce MFA for all Azure portal sign-ins regardless of risk, Identity Protection is too granular and conditional rather than a direct enforcement mechanism.
- ✗
Microsoft Entra ID Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management is designed for role-based access governance, offering just-in-time activation of Azure AD and Azure resource roles with the option to require MFA at activation time. It does not apply to all users — only users who have been assigned an eligible privileged role, and it does not protect the initial sign-in to the Azure portal outside of role activation. Thus, it cannot enforce MFA for every user accessing the portal as requested.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 204-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.