SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) only when users sign in from devices that are not compliant with company security policies. They also want to block sign-ins from unknown geographic locations. Which Microsoft Entra feature should they configure?
⚠ Common exam trap
It's easy for candidates to confuse Identity Protection's risk-based conditional access with the broader Conditional Access feature, not realizing that Identity Protection only provides risk signals and requires Conditional Access to enforce the actual MFA or block action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the correct feature because it allows administrators to create policies that evaluate signals such as device compliance and geographic location before granting access. By configuring a policy that requires MFA for non-compliant devices and blocks sign-ins from unknown locations, the security team can enforce these specific conditions. This granular control is unique to Conditional Access, which integrates with Microsoft Entra ID to enforce access decisions based on real-time risk and context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection focuses on detecting identity-based risks, such as compromised credentials or suspicious sign-in behaviors, and can trigger automated remediation actions like requiring a password change or an MFA challenge. However, its primary function is risk detection and response, not directly enforcing access policies based on explicit conditions like device compliance or network location, which are handled by Conditional Access.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and time-bound access to privileged roles within Microsoft Entra ID and Azure resources. While it can require MFA for role activation, its core purpose is elevating and securing administrative privileges, not enforcing general user sign-in policies based on device compliance or geographic location.
- ✓
Conditional Access
Why this is correct
Microsoft Entra Conditional Access is a policy engine that evaluates various signals, including user identity, device state, sign-in location, and application, to make real-time access decisions. It directly enables the creation of granular policies to enforce requirements like multi-factor authentication (MFA) or compliant devices, or to block access entirely, based on specific conditions such as device compliance or trusted network locations, precisely meeting the stated requirements.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) empowers users to securely reset their forgotten passwords or unlock their accounts without administrator intervention, utilizing pre-registered authentication methods. While it enhances user productivity and reduces helpdesk calls, SSPR's functionality is limited to password management and account unlock, and it does not provide the capability to enforce MFA or block sign-ins based on device compliance or network location as an access control mechanism.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.