SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. They want to configure a Conditional Access policy that requires multi-factor authentication (MFA) when a sign-in is assessed as medium or high risk by Microsoft's identity protection signals. For sign-ins with no detected risk, MFA should not be required. Which feature or service provides the risk assessment signals that can be consumed by Conditional Access policies?
⚠ Common exam trap
Many candidates confuse Privileged Identity Management (PIM) with Identity Protection because both involve 'identity' and 'security,' but PIM handles role activation and approval workflows, not risk-based sign-in analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection
Identity Protection is the Microsoft Entra service that analyzes billions of sign-in signals using machine learning to assign a risk level (low, medium, high) for each authentication attempt. Conditional Access policies can then consume these risk assessments directly as a condition, enabling granular MFA enforcement only when the sign-in risk is medium or high, while allowing low-risk sign-ins to proceed without MFA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity Protection
Why this is correct
Microsoft Entra ID Protection continuously monitors sign-in attempts and user behavior for anomalous activities, such as impossible travel, unfamiliar sign-in properties, or leaked credentials. It assigns a real-time risk score to each sign-in and user, which can then be directly consumed as a condition within Microsoft Entra Conditional Access policies. This allows organizations to enforce adaptive access controls, like multi-factor authentication or blocking access, based on the detected risk level.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and time-bound access to privileged roles. While it enhances security by reducing the standing access of administrators, PIM's primary function is not to detect or assess real-time sign-in risks based on user behavior or location. It focuses on the lifecycle and approval of elevated role assignments rather than generating risk signals for Conditional Access.
When this WOULD be correct
PIM would be correct if the question asked: 'Which feature provides time-bound role activation and approval workflows for privileged roles in Microsoft Entra ID?'
- ✗
Entitlement Management
Why it's wrong here
Microsoft Entra Entitlement Management enables organizations to manage identity and access lifecycle at scale by creating access packages that bundle resources and define approval workflows. It streamlines the process for users to request and receive access to groups, applications, and SharePoint sites. However, Entitlement Management's purpose is to automate access provisioning and reviews, not to analyze sign-in patterns or detect security risks associated with user authentication attempts.
When this WOULD be correct
A question asks: 'Which Microsoft Entra feature allows you to create access packages for internal and external users to request access to resources?' In that scenario, Entitlement Management is the correct answer.
- ✗
Identity Governance
Why it's wrong here
Identity Governance is a comprehensive framework within Microsoft Entra ID that ensures the right people have the right access to the right resources at the right time. It encompasses features like access reviews, lifecycle workflows, and PIM, focusing on auditing and managing access throughout an identity's lifecycle. While crucial for maintaining a strong security posture, Identity Governance itself does not provide the real-time, dynamic risk signals derived from sign-in behavior that are necessary for adaptive Conditional Access policies.
When this WOULD be correct
A question asks: 'Which Microsoft Entra feature enables automated access reviews and certification campaigns to ensure users have appropriate access?' In that context, Identity Governance would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Identity ProtectionCorrect answer▾
Why this is correct
Microsoft Entra ID Protection continuously monitors sign-in attempts and user behavior for anomalous activities, such as impossible travel, unfamiliar sign-in properties, or leaked credentials. It assigns a real-time risk score to each sign-in and user, which can then be directly consumed as a condition within Microsoft Entra Conditional Access policies. This allows organizations to enforce adaptive access controls, like multi-factor authentication or blocking access, based on the detected risk level.
✗Privileged Identity Management (PIM)Wrong answer — click to see why▾
Why this is wrong here
Privileged Identity Management (PIM) manages just-in-time access and role activation, not risk assessment signals. Risk signals for Conditional Access policies come from Identity Protection, not PIM.
★ When this WOULD be the correct answer
PIM would be correct if the question asked: 'Which feature provides time-bound role activation and approval workflows for privileged roles in Microsoft Entra ID?'
Why candidates choose this
Candidates may confuse PIM with Identity Protection because both deal with security and identity, and PIM involves elevated privileges that could be associated with higher risk.
✗Entitlement ManagementWrong answer — click to see why▾
Why this is wrong here
Entitlement Management manages access packages and resource access rights, not risk assessment signals. Conditional Access policies require risk signals from Identity Protection, not from Entitlement Management.
★ When this WOULD be the correct answer
A question asks: 'Which Microsoft Entra feature allows you to create access packages for internal and external users to request access to resources?' In that scenario, Entitlement Management is the correct answer.
Why candidates choose this
Candidates may confuse Entitlement Management with Identity Protection because both involve access control and governance, leading them to think Entitlement Management provides risk signals.
✗Identity GovernanceWrong answer — click to see why▾
Why this is wrong here
Identity Governance provides tools for managing user identities, access reviews, and lifecycle, but does not generate risk assessment signals for sign-ins. Risk signals come from Identity Protection, which analyzes user and sign-in behavior.
★ When this WOULD be the correct answer
A question asks: 'Which Microsoft Entra feature enables automated access reviews and certification campaigns to ensure users have appropriate access?' In that context, Identity Governance would be correct.
Why candidates choose this
Candidates may confuse Identity Governance with Identity Protection because both involve security and identity management, and the term 'governance' sounds like it could include risk assessment.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.