MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A company wants to ensure that all Microsoft 365 users authenticate using multi-factor authentication (MFA). Which Microsoft 365 security feature should they configure?
⚠ Common exam trap
MS-900 often tests the misconception that Intune compliance policies or Defender XDR enforce MFA, when in fact Conditional Access is the policy engine that requires MFA and can use compliance or risk as conditions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access
Microsoft Entra ID Conditional Access is the policy engine that evaluates signals (user, device, location, application, risk) and enforces access decisions, including requiring MFA. To ensure all Microsoft 365 users authenticate with MFA, an administrator creates a Conditional Access policy targeting all users and all cloud apps (or the Office 365 app suite) with a grant control of 'Require multifactor authentication.' This is the native, centralized mechanism for enforcing MFA across Microsoft 365 workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Intune compliance policies
Why it's wrong here
Microsoft Intune compliance policies evaluate device health attributes such as encryption status, jailbreak detection, and minimum OS version, but they do not directly challenge users for multi-factor authentication. While a noncompliant device could be blocked from accessing resources, this is a device-level access control, not an identity-level MFA enforcement mechanism.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention focuses on inspecting and protecting data in transit and at rest, preventing unauthorized sharing or exfiltration of sensitive information. It operates on content and data labels, not on authentication events, so it cannot require users to provide a second proof of identity like MFA.
- ✗
Microsoft Defender XDR
Why it's wrong here
Microsoft Defender XDR is a security analytics and threat response platform that aggregates signals from endpoints, email, and identity to detect and remediate attacks. Its primary function is post-breach detection and automated response; it does not contain features to require or enforce MFA at sign-in time.
- ✓
Microsoft Entra ID Conditional Access
Why this is correct
Microsoft Entra ID Conditional Access is the correct solution because it enables administrators to build granular policies that evaluate sign-in risk, location, device compliance, and user attributes, and then require MFA as one of the access controls. By targeting all users or specific groups, an organization can ensure MFA is enforced for every authentication attempt, satisfying the requirement.
Go deeper
Related to this question
Learn chapter
Intune Device Compliance and Configuration Policies
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.