MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
Which THREE of the following are capabilities of Microsoft Entra ID that support identity security? (Choose three.)
⚠ Common exam trap
MS-900 often tests whether candidates can distinguish Entra ID identity security features from broader Microsoft 365 security and management tools like Defender XDR and Intune.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is correct because it provides just-in-time privileged access with approval workflows, time-bound role activation, and access reviews, directly reducing standing admin rights in Microsoft Entra ID. Conditional Access is correct because it enforces signal-based access policies (user, device, location, risk) to grant, block, or require MFA/compliant device before access to resources. Identity Protection is correct because it detects and remediates identity risks using signals like leaked credentials, anonymous IP addresses, and atypical sign-in behavior, feeding risk detections into Conditional Access. Microsoft Defender XDR is not an Entra ID identity-security capability; it is a broader extended detection and response suite spanning endpoints, email, identities, and cloud apps. Microsoft Intune is a device and application management service (MDM/MAM) rather than a native Entra ID identity-security capability, even though it integrates with Conditional Access for device compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender XDR
Why it's wrong here
Defender XDR is a threat detection and response suite spanning endpoints, email and identities, not an Entra ID identity-security capability. It is tempting because it consumes Entra ID sign-in signals, but the question asks what Entra ID itself provides, such as Conditional Access or Identity Protection.
- ✗
Microsoft Intune
Why it's wrong here
Intune is a cloud-based endpoint management service for device configuration and compliance, not an Entra ID identity-security capability. It is tempting because Intune relies on Entra ID for enrolment and Conditional Access signals, but the question asks which capabilities Entra ID itself delivers.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Privileged Identity Management grants just-in-time, time-bound activation of elevated directory roles, with approval and audit trails. This satisfies identity security by eliminating standing administrative access, which is the primary risk PIM is designed to mitigate.
- ✓
Conditional Access
Why this is correct
Conditional Access evaluates signals such as user, device, location and risk, then enforces access decisions like requiring multifactor authentication or compliant devices. It satisfies the identity-security capability requirement by gating token issuance at authentication time rather than relying on static permissions.
- ✓
Identity Protection
Why this is correct
Identity Protection applies Microsoft's signal intelligence to detect risky users and risky sign-ins, then triggers automated remediation such as blocking or forcing password reset. This directly satisfies the identity-security capability requirement in the stem by addressing credential compromise and anomalous authentication behaviour.
Go deeper
Related to this question
Learn chapter
MFA and Conditional Access in M365
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.