MS-900 Describe Microsoft 365 apps and services Practice Question
Which THREE Microsoft 365 services are included in the Enterprise Mobility + Security (EMS) suite?
⚠ Common exam trap
Microsoft often tests the misconception that Microsoft Purview or Microsoft Sentinel are part of EMS, when in fact EMS focuses exclusively on identity, endpoint management, and cloud app security, not on SIEM or data governance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Intune
Microsoft Intune is a core component of Enterprise Mobility + Security (EMS) because it provides cloud-based mobile device management (MDM) and mobile application management (MAM) using the OMA-DM protocol. It enforces conditional access policies and allows IT to manage devices and applications without requiring on-premises infrastructure, directly aligning with EMS's goal of securing and managing endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution that ingests telemetry from multiple sources and automates incident response. It is not part of Enterprise Mobility + Security (EMS), because EMS focuses on identity, device management, and access control rather than security log analytics. Furthermore, Sentinel is licensed separately, often as an add-on to Microsoft 365 E5, and does not come bundled with the core EMS components.
- ✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a family of information protection, data governance, and compliance services—including data loss prevention, eDiscovery, and insider risk management—designed to help organizations meet regulatory requirements. While Purview integrates with Microsoft 365 workloads, it is not a component of the EMS suite, as EMS targets mobile device management, identity, and access security rather than compliance policy management. Purview licenses are typically purchased through Microsoft 365 Compliance or Information Protection add-ons, not through the EMS bundle.
- ✓
Microsoft Intune
Why this is correct
Microsoft Intune is a cloud-based endpoint management service that provides mobile device management (MDM) and mobile application management (MAM) across Windows, iOS, Android, and macOS. As a core EMS pillar, Intune enforces device configuration, deploys applications, and integrates with conditional access to restrict access to compliant devices. Without Intune, EMS would lack its primary mechanism for controlling user device security and application availability.
- ✓
Microsoft Entra ID
Why this is correct
Microsoft Entra ID, formerly Azure Active Directory, is the identity and access management backbone of EMS, handling authentication, single sign-on, multi-factor authentication, and conditional access. It provides the directory service that validates user identity and issues security tokens for access to cloud and on-premises resources. As the identity foundation of EMS, Entra ID is licensed in P1 or P2 editions within Microsoft 365 E3 or E5 and is indispensable to all other services in the suite.
- ✓
Microsoft Defender for Cloud Apps
Why this is correct
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that discovers shadow IT, controls access to sanctioned and unsanctioned cloud applications, and enforces data protection policies such as session-based monitoring. It is part of EMS because it extends identity and device controls into the SaaS ecosystem, mitigating risks from unsanctioned applications. Unlike Sentinel, which is a security operations tool, Defender for Cloud Apps focuses on real-time access control and visibility across cloud apps.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
MDM
MDM stands for Mobile Device Management, a technology that allows IT administrators to securely manage, monitor, and enforce policies on mobile devices like smartphones and tablets from a central console.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.