SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. They want to enforce a policy that requires members of the 'Finance' group to use multi-factor authentication and sign in from a compliant device when accessing the financial reporting application. However, they want to exclude members of the 'Finance Admins' group from these requirements. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
Test-takers frequently confuse Privileged Identity Management (PIM) with Conditional Access, thinking PIM can enforce MFA or device compliance, when in fact PIM only manages role activation and does not control sign-in conditions for specific applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the correct feature because it allows administrators to define policies that enforce specific access requirements, such as multi-factor authentication and compliant device usage, based on conditions like group membership. In this scenario, the policy targets the 'Finance' group while excluding the 'Finance Admins' group, which is a core capability of Conditional Access policies in Microsoft Entra ID.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is a security module focused on detecting potential vulnerabilities affecting an organization's identities and configuring automated responses to suspicious actions. It identifies anomalous sign-in behaviors, leaked credentials, and other risk events, then applies risk-based policies to block access or enforce multi-factor authentication in response to detected threats. However, Identity Protection's primary function is risk detection and remediation, not the proactive definition of granular access policies based on static conditions like group membership or device compliance.
When this WOULD be correct
A company wants to automatically block sign-ins from anonymous IP addresses or require MFA when a sign-in risk is detected as high. In that scenario, Identity Protection would be the correct feature to configure risk-based policies.
- ✓
Conditional Access
Why this is correct
Conditional Access policies in Microsoft Entra ID are the primary mechanism for enforcing granular access controls based on specific conditions. These policies evaluate various signals, such as user or group membership, application being accessed, device state (e.g., compliant or hybrid joined), and location, to determine whether to grant access, block access, or require additional authentication like multi-factor authentication (MFA) or a compliant device. This directly addresses the need to enforce a policy based on group membership and device compliance for application access.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within an organization by providing just-in-time (JIT) access to privileged roles. It focuses on minimizing the number of users with standing administrative access by requiring activation and often approval for elevated permissions. While crucial for security, PIM does not define general access policies for applications based on standard user group membership or device compliance for day-to-day access.
When this WOULD be correct
A company wants to require approval for activating the 'Global Administrator' role and limit its activation to 4 hours. PIM would be the correct feature to configure for time-bound, approved role activation.
- ✗
Entitlement Management
Why it's wrong here
Entitlement Management, a feature of Microsoft Entra ID Governance, enables organizations to manage identity and access lifecycle at scale by creating access packages that bundle resources like applications, groups, and SharePoint sites. It facilitates self-service access requests, approvals, and access reviews, particularly useful for onboarding and offboarding internal and external users. While it manages what resources users can access, it does not directly enforce how that access occurs (e.g., requiring MFA or a compliant device) based on real-time conditions like Conditional Access.
When this WOULD be correct
Entitlement Management would be correct if the question asked about automating access requests and approvals for the financial reporting application, such as creating an access package that requires manager approval and periodic access reviews for the Finance group.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Conditional AccessCorrect answer▾
Why this is correct
Conditional Access policies in Microsoft Entra ID are the primary mechanism for enforcing granular access controls based on specific conditions. These policies evaluate various signals, such as user or group membership, application being accessed, device state (e.g., compliant or hybrid joined), and location, to determine whether to grant access, block access, or require additional authentication like multi-factor authentication (MFA) or a compliant device. This directly addresses the need to enforce a policy based on group membership and device compliance for application access.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection is used to detect and respond to identity-based risks, such as compromised credentials or unusual sign-in behavior, but it does not enforce access policies like requiring MFA or compliant devices for specific groups or applications.
★ When this WOULD be the correct answer
A company wants to automatically block sign-ins from anonymous IP addresses or require MFA when a sign-in risk is detected as high. In that scenario, Identity Protection would be the correct feature to configure risk-based policies.
Why candidates choose this
Candidates may confuse Identity Protection with Conditional Access because both involve MFA and security policies, but Identity Protection focuses on risk detection rather than granular access control based on group membership and device compliance.
✗Privileged Identity Management (PIM)Wrong answer — click to see why▾
Why this is wrong here
Privileged Identity Management (PIM) manages just-in-time privileged access and role activation, not device compliance or MFA enforcement for specific groups. The question requires a policy that applies to a group with exclusions, which is a Conditional Access scenario.
★ When this WOULD be the correct answer
A company wants to require approval for activating the 'Global Administrator' role and limit its activation to 4 hours. PIM would be the correct feature to configure for time-bound, approved role activation.
Why candidates choose this
Candidates may confuse PIM with Conditional Access because both involve access control and security policies, but PIM focuses on privileged roles rather than user/device conditions.
✗Entitlement ManagementWrong answer — click to see why▾
Why this is wrong here
Entitlement Management is used for managing access packages and identity governance, not for enforcing sign-in conditions like MFA or device compliance. The scenario requires a policy that applies conditions based on group membership and application, which is the domain of Conditional Access.
★ When this WOULD be the correct answer
Entitlement Management would be correct if the question asked about automating access requests and approvals for the financial reporting application, such as creating an access package that requires manager approval and periodic access reviews for the Finance group.
Why candidates choose this
Candidates may confuse Entitlement Management with Conditional Access because both involve controlling access to resources, but Entitlement Management focuses on governance and lifecycle, not real-time sign-in enforcement.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Time-based One-time Password
A temporary, automatically generated code that changes every few seconds and is used as an extra layer of security when logging into an account.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.