MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A system administrator at Contoso needs to ensure that all users are required to use multi-factor authentication when accessing Microsoft 365 services. Which Microsoft 365 feature should the administrator use to enforce this requirement?
⚠ Common exam trap
It's easy for candidates to confuse email security or data protection features with authentication controls, assuming that any security policy can enforce MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Conditional Access policies
Conditional Access in Microsoft Entra ID is the centralized policy engine that evaluates signals like user, device, location, and application to enforce access controls, including requiring multi-factor authentication. It is the correct choice because it directly addresses authentication requirements for Microsoft 365 services, unlike the other options which focus on email security, data protection, or mail routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exchange Online mail flow rules
Why it's wrong here
Mail flow rules (transport rules) in Exchange Online are used to inspect and act on email messages based on conditions, such as blocking or encrypting messages. They operate on email content and routing, not on user authentication, so they cannot enforce multi-factor authentication for Microsoft 365 access.
- ✗
Microsoft Defender for Office 365 safe attachments policies
Why it's wrong here
Safe attachments policies are part of Microsoft Defender for Office 365 and are designed to scan email attachments for malware in a sandbox environment. They do not control authentication requirements for users accessing Microsoft 365 services, so they cannot enforce multi-factor authentication.
- ✓
Microsoft Entra ID Conditional Access policies
Why this is correct
Conditional Access policies in Microsoft Entra ID allow administrators to enforce multi-factor authentication based on conditions such as user group, location, device state, and application. This is the correct tool to require MFA for accessing Microsoft 365 services, providing granular control and integration with other security signals.
- ✗
Microsoft Purview Data Loss Prevention policies
Why it's wrong here
Data Loss Prevention policies in Microsoft Purview help prevent sharing of sensitive information, such as credit card numbers or personal data, across Microsoft 365 workloads. They do not manage user authentication or enforce multi-factor authentication, making them unsuitable for this requirement.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Security Center
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This MS-900 question is part of Courseiva's 794-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.