easyMultiple Choice
MS-102 Practice Question: Use Microsoft Entra ID Protection features such…
A company wants to use Microsoft Entra ID Protection features such as user risk policies and sign-in risk policies to automatically respond to risky behavior. Which Microsoft Entra ID license is required to enable these capabilities?
⚠ Common exam trap
Candidates often confuse Microsoft Entra ID P1 with P2, assuming Conditional Access alone enables risk policies, but P1 lacks the risk detection engine (Identity Protection) required for automated risk-based responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID P2
Microsoft Entra ID Protection features like user risk policies and sign-in risk policies require Microsoft Entra ID P2. This is because P2 includes Identity Protection, which provides risk-based conditional access policies that automatically respond to detected risks. Microsoft Entra ID P1 supports Conditional Access but lacks the risk detection and automated remediation capabilities of Identity Protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Free
Why it's wrong here
Microsoft Entra ID Free includes only basic directory synchronization and default security features such as Security Defaults, which enforce baseline MFA, but it does not expose Identity Protection, risk detections, or any risk-based Conditional Access policy. The risk engine that calculates user risk and sign-in risk is not present in the free tier, so neither administrators nor automated policies can view or act on compromised identities. Consequently, any scenario requiring user-risk remediation cannot be satisfied with the Free license.
- ✗
Microsoft Entra ID P1
Why it's wrong here
Microsoft Entra ID P1 grants a full Conditional Access engine, including conditions like device compliance and MFA trust, but the 'User risk' and 'Sign-in risk' conditions are explicitly locked to Premium P2 and are surfaced through Identity Protection. In P1, you can create access policies, but no risk signal is available to feed them; risk detections require the P2 Identity Protection service to calculate and publish those signals. Therefore, while P1 is a prerequisite for many advanced controls, it cannot enforce a policy that automatically reacts to user-risk detection.
- ✓
Microsoft Entra ID P2
Why this is correct
Microsoft Entra ID P2 is the correct license because it includes Identity Protection, which continuously analyzes user and sign-in risk, and adds risk conditions to Conditional Access so you can enforce policies such as requiring a password change when user risk is high. Along with Privileged Identity Management and entitlement management, P2 gives you both the detection and the automated remediation capabilities. This is the only Microsoft Entra ID edition listed that supports user-risk-based policies natively.
- ✗
Microsoft 365 E3
Why it's wrong here
Microsoft 365 E3 licensing includes Microsoft Entra ID Plan 1, which is functionally equivalent to Microsoft Entra ID P1, so it provides Conditional Access but omits the P2-only Identity Protection features like user risk and sign-in risk evaluations. Without an add-on such as Microsoft Entra ID P2 or an upgrade to Microsoft 365 E5, the tenant cannot apply risk-based policies or access the Identity Protection portal's risk reports. Thus, selecting E3 would not satisfy the requirement for user-risk functionality.
Go deeper
Related to this question
Learn chapter
Safe Links and Safe Attachments Policies
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.