MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A service owner is comparing Microsoft 365 capabilities and needs to make sign-in decisions based on risk, location, and device compliance. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Candidates often confuse Microsoft 365 productivity tools (Forms, Planner, Stream) with security or identity services, failing to recognize that Conditional Access is the only option that directly controls sign-in decisions based on risk, location, and device compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy
Conditional Access policy is the correct answer because it is the Microsoft Entra ID (formerly Azure AD) feature that enforces sign-in decisions based on risk, location, and device compliance. It allows administrators to create policies that require multi-factor authentication, block access from untrusted locations, or require compliant devices before granting access to Microsoft 365 resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms is a service for building surveys, quizzes, and feedback forms, with results stored in Excel and backed by standard sharing permissions. It does not perform real-time evaluation of authentication context, user risk, or device posture, nor does it enforce any conditional access decisions on other Microsoft 365 workloads. Therefore it is not a security or compliance control capability and cannot satisfy the requirement.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a lightweight project management tool built into Microsoft 365 that enables teams to create boards, assign tasks, set due dates, and track progress on work items. It provides no mechanism for evaluating user identity signals or applying security and compliance access conditions at sign-in or resource access time. Its role is purely organizational, so it is an incorrect choice for enforcing conditional access controls.
- ✓
Conditional Access policy
Why this is correct
Conditional Access is the correct capability because it operates at the identity layer, collecting signals such as user or group membership, location, device compliance, and real-time risk before allowing access. It enforces granular controls like requiring multi-factor authentication, blocking access from untrusted networks, or restricting to compliant devices. This is precisely the Microsoft Entra ID/Entra ID security feature designed to protect resources, making it the appropriate choice for identity-based access enforcement.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream is a video content management platform where organizations upload, stream, and share recorded or live events. Its only access controls are standard SharePoint/OneDrive-style sharing permissions that are attached to individual video files, not adaptive, signal-based policies. It cannot evaluate sign-in risk, device health, or location to dynamically allow or block access, so it does not meet this requirement.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Service Health Dashboard
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.