Describe the capabilities of Microsoft Entra →mediumMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

A company uses Microsoft Entra ID. The IT department wants to ensure that users are prompted to change their password only when there is a high likelihood that their credentials have been compromised, rather than forcing periodic password changes. They also want to block users from using common passwords from a custom list of banned passwords. Which Microsoft Entra features should they use?

⚠ Common exam trap

Candidates often confuse Identity Protection with Conditional Access, assuming risk-based policies are the same as password change triggers, or they think Password Protection is part of MFA or PIM, when in fact it is a separate feature focused solely on password content validation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identity Protection and Password Protection

Identity Protection uses machine learning to detect leaked credentials and risky sign-in behaviors, triggering a password change prompt only when compromise is likely, not on a fixed schedule. Password Protection enforces custom banned password lists (e.g., common passwords or company-specific terms) at the time of password change or reset, blocking weak passwords in real time.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Identity Protection and Password Protection
Why this is correct
Microsoft Entra Identity Protection actively detects potential vulnerabilities affecting user identities, such as leaked credentials or risky sign-in behaviors, and can automate remediation actions including forcing a password change for high-risk users. Microsoft Entra Password Protection specifically prevents users from creating weak, commonly used, or custom-banned passwords, directly addressing the prevention of easily guessable or compromised passwords within the organization.
✗
Conditional Access and Multi-Factor Authentication
Why it's wrong here
Microsoft Entra Conditional Access defines policies that control *when* and *how* users can access resources based on specific conditions like device state or location, but it does not enforce password changes or manage password strength. Multi-Factor Authentication (MFA) adds an essential layer of security by requiring a second verification method during sign-in, enhancing overall authentication security, but it does not prevent the use of weak passwords or initiate password resets.
✗
Privileged Identity Management and Identity Governance
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources by providing just-in-time and just-enough access for privileged roles, not general user password policies. Microsoft Entra Identity Governance encompasses managing user identities and access throughout their lifecycle, including access reviews and entitlement management, but neither service directly addresses the enforcement of strong password policies or the blocking of weak passwords.
✗
Access Reviews and Entitlement Management
Why it's wrong here
Microsoft Entra Access Reviews enable organizations to periodically review who has access to specific resources and whether that access is still necessary, ensuring the principle of least privilege is maintained. Microsoft Entra Entitlement Management allows organizations to manage identity and access lifecycle at scale by creating access packages for resources. Neither of these features is designed to enforce password complexity, block weak passwords, or initiate password changes based on risk.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Why each option matters

Option-by-option breakdown

Related to this question