SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to automatically detect user behaviors that indicate possible compromise, such as leaked credentials, impossible travel, or anomalous login patterns. When a user is determined to be at high risk, the system should automatically require the user to reset their password the next time they sign in. Which Microsoft Entra capability should they use?
⚠ Common exam trap
Microsoft often tests the distinction between detection and enforcement: candidates mistakenly choose Conditional Access because it enforces the password reset, but the question asks for the capability that automatically detects the risky behaviors, which is Identity Protection—Conditional Access is the enforcement mechanism, not the detection engine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection
Identity Protection is the correct Microsoft Entra capability because it is specifically designed to automatically detect risky user behaviors such as leaked credentials, impossible travel, and anomalous sign-in patterns. It assigns a risk level to users and sign-ins, and can be configured with a Conditional Access policy to enforce actions like requiring a password reset at next sign-in when a user is deemed high risk. This directly matches the security team's requirement for automated detection and remediation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies define access requirements based on various signals, including user risk from Identity Protection. However, its primary actions are to grant access with specific controls (like requiring multi-factor authentication) or to block access entirely. It does not natively initiate an automated password reset as a direct enforcement action; instead, it relies on Identity Protection to flag the user for such remediation.
- ✓
Identity Protection
Why this is correct
Microsoft Entra ID Protection is specifically designed to detect and remediate identity-based risks. It analyzes sign-in and user behavior to identify threats like impossible travel, leaked credentials, or unfamiliar sign-in properties. Crucially, it allows administrators to configure user risk policies that can automatically enforce actions such as requiring a password reset or blocking access when a user's risk level is deemed high, directly addressing the need for automated remediation.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to privileged roles within Microsoft Entra ID, Azure resources, and other Microsoft services. Its core functionality involves just-in-time access, approval workflows for role activation, and periodic access reviews to minimize standing access. PIM is not designed for detecting general user sign-in risks or automatically resetting passwords for potentially compromised standard user accounts.
- ✗
Identity Governance
Why it's wrong here
Microsoft Entra Identity Governance provides capabilities to ensure the right people have the right access to the right resources at the right time. This suite includes entitlement management for access packages, access reviews for periodic verification, and lifecycle workflows for automating user provisioning and deprovisioning. While essential for managing access lifecycles, Identity Governance does not include the real-time risk detection and automated remediation features, such as forcing a password reset, that are offered by Identity Protection.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.