SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. They want to ensure that users who are traveling to a high-risk country, based on the sign-in IP address, are prompted for multi-factor authentication before accessing the company's CRM application. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
Watch out — candidates often confuse Identity Protection's risk-based MFA (which uses machine learning on user behavior) with Conditional Access's location-based MFA (which uses static IP-to-country mapping), leading them to select Identity Protection when the question explicitly specifies a high-risk country based on IP address rather than a risk score.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the correct feature because it allows administrators to create policies that evaluate sign-in signals—such as the user's location derived from the IP address—and enforce access controls like requiring multi-factor authentication (MFA) before granting access to a specific application (e.g., the CRM app). By configuring a Conditional Access policy with a location condition targeting high-risk countries, the company can ensure that only users signing in from those IP ranges are prompted for MFA, while other sign-ins proceed normally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access
Why this is correct
Conditional Access policies are the primary mechanism in Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. Administrators can define "Named locations" using IP ranges or countries/regions, then create policies that require specific controls, such as multi-factor authentication (MFA), when users attempt to access applications from outside these trusted locations. This directly addresses the requirement to enforce location-based MFA for application access.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection focuses on detecting and remediating identity-based risks, such as compromised credentials, anomalous sign-ins, or unfamiliar locations. While it identifies risky sign-ins, which might indirectly involve location anomalies, it does not directly define or enforce access policies based on specific geographic locations or IP ranges. Instead, Identity Protection feeds risk signals into Conditional Access policies, which then apply the actual access controls like requiring MFA for risky sign-ins.
When this WOULD be correct
Identity Protection would be correct if the question asked: 'Which feature identifies and reports risky sign-ins, such as those from anonymous IP addresses or atypical travel, but does not enforce access policies?'
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft services. Its core function is to provide just-in-time and just-enough access to privileged roles, reducing the risk of standing access. While PIM can integrate with Conditional Access to require MFA for role activation, it does not inherently enforce location-based MFA for general application access; its focus is on privileged role management.
When this WOULD be correct
A company needs to manage just-in-time privileged access to Azure AD roles, requiring approval and time-bound activation for administrators. PIM would be the correct feature to configure.
- ✗
Azure AD Join
Why it's wrong here
Azure AD Join is a device management capability that registers devices directly with Microsoft Entra ID, providing single sign-on to cloud resources and enabling device-based Conditional Access. It establishes a device identity and allows for device compliance checks. However, Azure AD Join itself does not define or enforce access policies based on the user's geographic location or IP address; its primary function is device registration and management within the Entra ID ecosystem.
When this WOULD be correct
An exam question asking how to enable single sign-on and device management for corporate-owned Windows devices that are not domain-joined, with the goal of applying device-based conditional access policies.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Conditional AccessCorrect answer▾
Why this is correct
Conditional Access policies are the primary mechanism in Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. Administrators can define "Named locations" using IP ranges or countries/regions, then create policies that require specific controls, such as multi-factor authentication (MFA), when users attempt to access applications from outside these trusted locations. This directly addresses the requirement to enforce location-based MFA for application access.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection provides risk detection and remediation, but it does not enforce access controls like MFA prompts. Conditional Access is required to apply policies based on sign-in risk or location.
★ When this WOULD be the correct answer
Identity Protection would be correct if the question asked: 'Which feature identifies and reports risky sign-ins, such as those from anonymous IP addresses or atypical travel, but does not enforce access policies?'
Why candidates choose this
Candidates confuse Identity Protection's risk detection capabilities with the policy enforcement that Conditional Access provides, assuming risk detection alone can trigger MFA.
✗Privileged Identity ManagementWrong answer — click to see why▾
Why this is wrong here
Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Microsoft Entra ID, but it does not enforce location-based multi-factor authentication prompts for specific applications.
★ When this WOULD be the correct answer
A company needs to manage just-in-time privileged access to Azure AD roles, requiring approval and time-bound activation for administrators. PIM would be the correct feature to configure.
Why candidates choose this
Candidates may confuse PIM's role-based access controls with Conditional Access policies, assuming that managing privileged roles includes controlling authentication requirements based on risk.
✗Azure AD JoinWrong answer — click to see why▾
Why this is wrong here
Azure AD Join is used to join devices to Azure AD for single sign-on and management, not to enforce conditional access policies based on sign-in risk or location.
★ When this WOULD be the correct answer
An exam question asking how to enable single sign-on and device management for corporate-owned Windows devices that are not domain-joined, with the goal of applying device-based conditional access policies.
Why candidates choose this
Candidates may confuse Azure AD Join with Azure AD Conditional Access because both involve device identity and access control, but Azure AD Join is about device registration, not policy enforcement.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Conditional Access policy
A Conditional Access policy is a set of rules in Microsoft Entra ID that automatically grants or blocks access to cloud apps based on signals like user identity, location, device health, and risk level.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.