MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A company wants to ensure that only managed and compliant devices can access corporate email in Microsoft 365. Which Microsoft Entra ID capability should they configure?
⚠ Common exam trap
MS-900 often tests the difference between authentication controls (MFA, Authenticator) and authorization/access controls (Conditional Access), so candidates who focus on 'access email' and pick an MFA option miss the device-compliance enforcement mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access in Microsoft Entra ID is the policy engine that evaluates signals like device compliance and management state, then grants or blocks access to Microsoft 365 services such as Exchange Online. Configuring a policy that requires a compliant or hybrid Microsoft Entra ID joined device ensures only managed, compliant devices can reach corporate email. This is the precise Entra ID capability designed for that enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access
Why this is correct
Conditional Access enforces signal-based access decisions, so device compliance state from Intune can be required before Microsoft 365 email is granted. This directly satisfies the stem's constraint that only managed, compliant devices reach corporate email, since the policy evaluates device state at authentication rather than relying on user credentials alone.
- ✗
Microsoft Authenticator
Why it's wrong here
Microsoft Authenticator supplies multi-factor authentication prompts and passwordless sign-in; it reports nothing about whether a device is managed or compliant. Conditional Access evaluates device state to gate Exchange Online access. Authenticator is tempting because it strengthens sign-in security, but it verifies the user, not the device.
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management governs just-in-time activation of privileged directory roles; it evaluates no device compliance signal. Conditional Access is what enforces managed, compliant device requirements for Exchange Online. PIM is tempting because it also strengthens access control, but it targets administrative role elevation rather than device state.
- ✗
Identity Protection
Why it's wrong here
Identity Protection detects and scores risky users and sign-ins, feeding risk-based Conditional Access policies; it never checks device management or compliance state. Conditional Access enforces the compliant-device requirement. Identity Protection is tempting because it also drives access decisions, but its signals concern user risk, not device posture.
Go deeper
Related to this question
Learn chapter
Exchange Online Protection (EOP)
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.