SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel between geographically distant locations within an unrealistic time frame. They need a solution that can automatically trigger actions like forcing a password reset or blocking sign-in for users identified as high risk. Which Microsoft Entra ID capability should they configure?
⚠ Common exam trap
Candidates often confuse Conditional Access with Identity Protection, but Conditional Access is the enforcement mechanism that requires a risk signal from Identity Protection to trigger automated responses like blocking or password reset.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Identity Protection
Microsoft Entra Identity Protection is the correct capability because it is specifically designed to detect and automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel. It uses machine learning to assign risk levels and can trigger automated actions like forcing a password reset or blocking sign-in for high-risk users, aligning directly with the security team's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access is a powerful policy engine that enforces access decisions based on various conditions, such as user location, device compliance, or application being accessed. It can consume risk signals from Identity Protection to make decisions like blocking access or requiring MFA, but it does not detect the risks itself or initiate automated remediation actions like password resets. Conditional Access primarily controls *how* users access resources, rather than detecting and responding to inherent identity risks.
When this WOULD be correct
A company wants to enforce access controls, such as requiring multi-factor authentication or blocking access from specific locations, based on conditions like user group, device compliance, or application sensitivity. Conditional Access would be the correct capability to configure.
- ✓
Microsoft Entra Identity Protection
Why this is correct
Microsoft Entra Identity Protection is the correct service for detecting identity-based risks and configuring automated responses. It leverages Microsoft's vast threat intelligence to identify suspicious activities like impossible travel, leaked credentials, or unfamiliar sign-in properties. Based on the detected risk level, Identity Protection can automatically enforce actions such as requiring multi-factor authentication, forcing a password reset, or blocking access entirely for compromised or high-risk user accounts, thereby proactively securing identities.
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. Its primary function is to provide just-in-time (JIT) and just-enough-access (JEA) for privileged roles, requiring activation and often multi-factor authentication for elevated permissions. PIM focuses on securing administrative roles and reducing the attack surface of standing access, not on detecting and responding to general user identity risks or suspicious sign-in activities.
When this WOULD be correct
A question asking which Microsoft Entra capability should be used to provide just-in-time privileged access, require approval for role activation, or enforce multi-factor authentication for elevated roles. For example: 'The security team needs to ensure that administrators must request approval before activating a privileged role.'
- ✗
Microsoft Entra Identity Governance
Why it's wrong here
Microsoft Entra Identity Governance focuses on managing the identity and access lifecycle, ensuring that the right people have the right access to the right resources at the right time. This includes features like access reviews, entitlement management, and lifecycle workflows for joining, moving, and leaving an organization. While crucial for security and compliance, it does not directly perform real-time risk detection or automated remediation of suspicious sign-ins or user behaviors.
When this WOULD be correct
A company needs to automate access reviews, enforce entitlement management, and ensure proper governance of user access to resources over time. The question would ask for a solution to manage user roles and access certifications.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Entra Identity ProtectionCorrect answer▾
Why this is correct
Microsoft Entra Identity Protection is the correct service for detecting identity-based risks and configuring automated responses. It leverages Microsoft's vast threat intelligence to identify suspicious activities like impossible travel, leaked credentials, or unfamiliar sign-in properties. Based on the detected risk level, Identity Protection can automatically enforce actions such as requiring multi-factor authentication, forcing a password reset, or blocking access entirely for compromised or high-risk user accounts, thereby proactively securing identities.
✗Microsoft Entra Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access enforces policies based on signals like location or device state, but it does not automatically detect or respond to risk events like anonymous IP addresses or impossible travel. Identity Protection is required to evaluate risk levels and trigger automated responses.
★ When this WOULD be the correct answer
A company wants to enforce access controls, such as requiring multi-factor authentication or blocking access from specific locations, based on conditions like user group, device compliance, or application sensitivity. Conditional Access would be the correct capability to configure.
Why candidates choose this
Candidates may confuse Conditional Access with risk-based policies, not realizing that Conditional Access relies on risk signals from Identity Protection rather than generating them itself.
✗Microsoft Entra Privileged Identity ManagementWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Azure AD, Azure, and other Microsoft Online Services. It does not detect or automatically respond to risky user behaviors like anonymous IP sign-ins or impossible travel.
★ When this WOULD be the correct answer
A question asking which Microsoft Entra capability should be used to provide just-in-time privileged access, require approval for role activation, or enforce multi-factor authentication for elevated roles. For example: 'The security team needs to ensure that administrators must request approval before activating a privileged role.'
Why candidates choose this
Candidates may confuse 'automatically respond to risky behaviors' with 'automatically manage privileged access,' mistakenly thinking that PIM's automated role activation policies can also address user risk scenarios.
✗Microsoft Entra Identity GovernanceWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Identity Governance focuses on managing user access rights, certifications, and lifecycle, not on detecting and automatically responding to risky sign-in behaviors like anonymous IPs or impossible travel.
★ When this WOULD be the correct answer
A company needs to automate access reviews, enforce entitlement management, and ensure proper governance of user access to resources over time. The question would ask for a solution to manage user roles and access certifications.
Why candidates choose this
Candidates may confuse 'governance' with 'security' or think that managing risk is part of governance, but Identity Governance is about access policies and reviews, not real-time risk detection.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.