MS-900 Describe Microsoft 365 apps and services Practice Question
A company uses Microsoft 365 Business Premium. All users have Microsoft 365 E3 licenses, but the IT team wants to enforce conditional access policies to require multifactor authentication (MFA) for all external access to SharePoint Online. Which service should they use to create and manage these policies?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Intune's device compliance policies with Conditional Access policies, but Intune only provides the compliance state signal, while Entra ID is the service that evaluates and enforces the access decision.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID
Microsoft Entra ID (formerly Azure AD) is the identity and access management service that provides Conditional Access policies, which can require MFA for external access to SharePoint Online. These policies are evaluated at authentication time based on signals like user location, device state, and application, and they are independent of the underlying Microsoft 365 license (E3 or Business Premium).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender XDR
Why it's wrong here
Microsoft Defender XDR is a security analytics and threat response platform that aggregates signals from endpoints, email, identities, and applications to detect and remediate attacks. It does not contain the policy engine for controlling authentication or sign-in requirements, so it cannot enforce MFA or create conditional access policies. Those capabilities reside in Microsoft Entra ID, where Conditional Access policies are defined and evaluated during the sign-in process.
- ✗
Microsoft Intune
Why it's wrong here
Intune is a cloud-based unified endpoint management service for enrolling and managing devices, deploying apps, and enforcing device compliance and configuration settings. While Intune can report device compliance status that Conditional Access policies may consume, Intune itself does not decide whether a user must perform MFA or define conditional access rules. MFA enforcement is a central identity function of Entra ID Conditional Access, not an endpoint management feature.
- ✓
Microsoft Entra ID
Why this is correct
Microsoft Entra ID (formerly Azure Active Directory) is the identity and access management service in Microsoft 365, and its Conditional Access engine is the correct place to enforce MFA for all users. Conditional Access policies evaluate sign-in signals such as user risk, device state, location, and application, and then require MFA or block access. Administrators would create a policy in Entra ID to require MFA for all users or specific conditions, which is exactly what this scenario demands.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a comprehensive set of solutions for data governance, compliance, and risk management, including sensitivity labels, data loss prevention, eDiscovery, and audit logging. These capabilities focus on protecting and governing data after access has been granted, not on controlling authentication at sign-in. Requiring MFA is an access control decision that occurs during authentication, which is handled by Entra ID Conditional Access, so Purview is not the correct answer.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Service Health Dashboard
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.