SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID (Microsoft Entra ID) for identity management. They want to automatically block sign-ins from users whose credentials have been compromised and require them to change their password before access is granted. Which Microsoft Entra ID capability should they use?
⚠ Common exam trap
Many exam-takers confuse Conditional Access policies with risk-based policies, but Conditional Access alone cannot detect compromised credentials or enforce password changes—it requires Entra ID Protection as the risk signal source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Protection
Microsoft Entra ID Protection is the correct capability because it automatically detects compromised credentials by analyzing telemetry from Microsoft's Threat Intelligence and the wider ecosystem. When a user's credentials are found in a known leak, Entra ID Protection can enforce a policy that blocks sign-in and requires the user to change their password via an integrated remediation workflow, directly addressing the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Protection
Why this is correct
Microsoft Entra ID Protection is specifically designed to detect and remediate identity-based risks, including compromised credentials. It leverages machine learning to identify suspicious activities like leaked credentials, anomalous sign-ins, and impossible travel. Upon detection, it can automatically enforce policies such as blocking sign-ins, requiring multi-factor authentication, or prompting for a password change, thereby directly protecting against credential compromise.
- ✗
Conditional Access policies
Why it's wrong here
Conditional Access policies are an enforcement engine that uses signals from various sources, including Microsoft Entra ID Protection, to make access decisions. While it can block access or require additional authentication based on a detected risk, Conditional Access itself does not possess the inherent capability to detect compromised credentials. It relies on upstream services like Identity Protection to provide the risk assessment before applying its access controls.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft services. Its primary function is to provide just-in-time and just-enough access for privileged roles, reducing the attack surface associated with standing administrative permissions. PIM is not designed to detect or prevent the compromise of standard user credentials, but rather to secure the use of high-privilege accounts.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) empowers users to reset their own forgotten or expired passwords without administrator intervention. While it improves user experience and reduces helpdesk calls, SSPR does not include any mechanisms for proactively detecting or blocking compromised credentials. It is a reactive tool for password management, not a security service for identifying and mitigating identity-based threats like credential compromise.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Threat intelligence
Threat intelligence is evidence-based knowledge about existing or emerging cyber threats that helps organizations defend against attacks.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.