AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Which TWO Microsoft Entra ID editions include Conditional Access? (Choose two.)
⚠ Common exam trap
Many exam-takers confuse Microsoft 365 Business Basic (which includes only Microsoft Entra ID Free) with a higher-tier license that includes Conditional Access, or mistakenly think legacy Microsoft Entra ID Basic still supports Conditional Access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID P1
Microsoft Entra ID P1 includes Conditional Access, which allows organizations to enforce access policies based on signals like user, location, device, and application. This edition provides the core Conditional Access capabilities needed for most enterprise scenarios, such as requiring multi-factor authentication or blocking access from untrusted locations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID P1
Why this is correct
Microsoft Entra ID P1 is the entry-level premium edition that licenses the Conditional Access policy engine. It evaluates a rich set of signals—including user identity, group membership, device status, and geographic location—to grant, block, or require multifactor authentication on every authentication request. P1 is available as a standalone SKU or via Microsoft 365 E3/E5 and Enterprise Mobility+Security E3, and it covers most policy-driven conditional access scenarios such as 'require MFA for all users' or 'block legacy authentication protocols.'
- ✓
Microsoft Entra ID P2
Why this is correct
Microsoft Entra ID P2 is the most comprehensive edition, building upon P1 with advanced identity protection and governance capabilities. Conditional Access is a core security feature designed to enforce policies based on user, device, and location conditions, and it is fully integrated into Microsoft Entra ID P2. This edition therefore directly satisfies the question's requirement to identify an Entra ID edition that includes Conditional Access, providing robust access control for organisations.
- ✗
Microsoft Entra ID Basic (legacy)
Why it's wrong here
Microsoft Entra ID Basic was a legacy entry-level SKU, commonly included in earlier CSP subscriptions and IaaS workloads, that added only a few non-security capabilities such as self-service group and application management. It did not include Conditional Access because that feature was deliberately reserved for the Premium editions (P1 and P2) and required Microsoft Entra ID Premium infrastructure. Basic offered only static per-user or per-tenant toggles rather than a rules-based evaluation engine, so it could not enforce context-sensitive access decisions; Microsoft has since deprecated this edition.
- ✗
Microsoft 365 Business Basic
Why it's wrong here
Microsoft 365 Business Basic is a low-cost productivity subscription that bundles Exchange Online, SharePoint Online, and web/mobile Office apps, but its identity layer is Microsoft Entra ID Free. The Free edition provides baseline directory services like user and group administration and single sign-on, but it lacks Conditional Access entirely. To enforce access policies such as requiring a compliant device for SharePoint sign-in, customers must upgrade to Microsoft 365 Business Premium or add the Enterprise Mobility + Security (EMS) suite, which includes Entra ID P1.
- ✗
Microsoft Entra ID Free
Why it's wrong here
Microsoft Entra ID Free is the default edition in every Azure and Microsoft 365 subscription, yet it contains no Conditional Access functionality. It supports up to 500,000 directory objects, basic SSO, and per-user MFA toggles, but these are static settings that do not assess device trust, sign-in risk, or location in real time. Free cannot enforce even a simple conditional access policy such as 'block access from unapproved countries' or 'require a compliant device for high-privilege roles'; those require Microsoft Entra ID P1 or P2.
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.