A company uses Microsoft Entra ID (Microsoft Entra ID). They want to require multi-factor authentication (MFA) for all users accessing the Azure portal, but do not want MFA to be required for other applications like Office 365. Which Microsoft Entra ID feature should they configure?

Microsoft Entra ID Identity Protection

Identity Protection detects risky sign-ins but does not enforce MFA directly; it integrates with Conditional Access to require MFA based on risk level, which is not the requirement here.

Microsoft Entra ID Security defaults

Security defaults enforce MFA for all users and all applications, which does not meet the requirement to only require MFA for the Azure portal.

Microsoft Entra ID Privileged Identity Management (PIM)

PIM manages just-in-time access for privileged roles and can require MFA on activation, but it does not apply to all users accessing the Azure portal.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Conditional Access — Microsoft Entra ID Conditional Access policies allow administrators to apply access controls based on conditions such as cloud apps, users, locations, and device state. A conditional access policy targeting the Azure portal cloud app can require MFA, leaving other apps unaffected. Identity Protection detects risks but does not enforce MFA by itself. PIM manages privileged roles. Security defaults would enforce MFA for all users and all apps, which is too broad.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.