MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
Which TWO are prerequisites for implementing Microsoft Entra ID Identity Protection? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse the licensing requirement for Identity Protection (P2) with the broader Conditional Access feature (P1), or assume that audit logs or SSPR are mandatory prerequisites when they are not directly required for Identity Protection's core functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID P2 license
Microsoft Entra ID Identity Protection requires a Microsoft Entra ID P2 license because it uses advanced risk detection and automated remediation capabilities (e.g., risk-based Conditional Access policies, user risk and sign-in risk policies) that are only available in the P2 tier. The P1 license provides basic Conditional Access but lacks the risk detection engine and adaptive policies that Identity Protection relies on.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID P2 license
Why this is correct
Microsoft Entra ID P2 licensing is a hard prerequisite for implementing Identity Protection because risk detections, risk-based conditional access policies, and the Identity Protection report views are only included in the P2 tier. Attempting to configure these in a tenant with only P1 or free licensing will fail validation, as the underlying risk engine and policy controls are not provisioned.
- ✗
Microsoft Entra ID P1 license
Why it's wrong here
A Microsoft Entra ID P1 license supplies conditional access, MFA, and self-service password reset, but it does not include Identity Protection. Since the question's objective is implementing Identity Protection, P1 is insufficient and cannot be substituted for the P2 entitlement that the feature requires.
- ✓
Identity Protection administrator role assigned
Why this is correct
Deploying Identity Protection requires an account with the Identity Protection Administrator role, which has the permissions to read risk detections, configure user risk and sign-in risk policies, and respond to confirmed compromises. Without this administrative role, a global administrator might technically have access, but the prerequisite role is necessary for least-privilege configuration and ongoing management of the feature.
- ✗
Audit logs enabled for sign-in events
Why it's wrong here
Audit logs for sign-in events are generated by default for all directory activity, so enabling them is not an implementation prerequisite. Identity Protection relies on its own risk event data from Microsoft's detection engine, not on the organization's sign-in audit log, making this option unrelated and unnecessary.
- ✗
Self-service password reset configured
Why it's wrong here
Self-service password reset (SSPR) is an independent feature that may be deployed alongside Identity Protection, but it is not a dependency or prerequisite for it. Configuring SSPR requires its own licensing and policy setup, and implementing Identity Protection is entirely possible even when SSPR remains disabled.
Go deeper
Related to this question
Learn chapter
Entra ID Protection and Risk Policies
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.