SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. They want to require multi-factor authentication (MFA) for users who sign in from locations with a high risk score, as determined by Microsoft's analysis of the sign-in's IP address and other behavioral signals. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
Many candidates confuse Conditional Access as the feature that evaluates risk, when in fact Conditional Access is the policy engine that enforces controls, but Identity Protection is the service that generates the risk scores used as conditions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity Protection
Identity Protection is the correct feature because it provides risk-based detection and remediation, including the ability to automatically enforce MFA when a sign-in is flagged with a high risk score. It uses machine learning models to analyze signals such as anonymized IP addresses, atypical travel, and leaked credentials to assign a risk level. This directly matches the requirement to require MFA based on Microsoft's analysis of the sign-in's IP address and behavioral signals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identity Protection
Why this is correct
Microsoft Entra ID Protection is the dedicated service for detecting identity-based risks, including both sign-in risk and user risk, using adaptive machine learning and heuristics. It continuously monitors sign-in attempts and user behavior for anomalies like impossible travel, unfamiliar sign-in properties, or leaked credentials. Based on these detections, Identity Protection can automatically trigger responses such as requiring multi-factor authentication, enforcing a password change, or blocking access, thereby directly addressing the need for risk-based MFA.
- ✗
Conditional Access
Why it's wrong here
Conditional Access can enforce MFA based on many conditions, including sign-in risk, but the risk assessment itself comes from Identity Protection. The question asks for the feature that provides this capability, which is Identity Protection.
When this WOULD be correct
A company wants to enforce MFA for all users accessing a sensitive app from outside the corporate network. They should configure a Conditional Access policy to require MFA based on location or network conditions.
- ✗
Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources in Microsoft Entra ID, Azure, and other Microsoft Online Services. Its primary function is to provide just-in-time (JIT) access to administrative roles, requiring users to activate their elevated permissions for a limited time. While PIM can enforce MFA during role activation, it does not provide continuous, risk-based MFA enforcement for all user sign-ins, which is a distinct capability.
When this WOULD be correct
A company needs to provide just-in-time privileged access to Azure AD roles, requiring approval and time-bound activation for administrators. In this scenario, Privileged Identity Management would be the correct feature to configure.
- ✗
Entitlement Management
Why it's wrong here
Microsoft Entra Entitlement Management is a governance feature that enables organizations to manage identity and access lifecycle at scale, particularly for external users and self-service scenarios. It allows administrators to create access packages, which bundle resources like groups, applications, and SharePoint sites, and define policies for requesting and approving access. This service focuses on granting and reviewing access rights to resources, not on detecting real-time sign-in risks or enforcing adaptive MFA policies based on those risks.
When this WOULD be correct
An exam scenario where the question asks: 'Which Microsoft Entra ID feature should be used to create and manage access packages for internal and external users to govern access to resources?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Identity ProtectionCorrect answer▾
Why this is correct
Microsoft Entra ID Protection is the dedicated service for detecting identity-based risks, including both sign-in risk and user risk, using adaptive machine learning and heuristics. It continuously monitors sign-in attempts and user behavior for anomalies like impossible travel, unfamiliar sign-in properties, or leaked credentials. Based on these detections, Identity Protection can automatically trigger responses such as requiring multi-factor authentication, enforcing a password change, or blocking access, thereby directly addressing the need for risk-based MFA.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access is the policy engine that enforces MFA, but it relies on a risk assessment from Identity Protection. The question asks for the feature that determines the risk score, which is Identity Protection, not Conditional Access.
★ When this WOULD be the correct answer
A company wants to enforce MFA for all users accessing a sensitive app from outside the corporate network. They should configure a Conditional Access policy to require MFA based on location or network conditions.
Why candidates choose this
Candidates often confuse Conditional Access as the feature that provides risk detection, when in fact it only consumes risk signals from Identity Protection to enforce policies.
✗Privileged Identity ManagementWrong answer — click to see why▾
Why this is wrong here
Privileged Identity Management (PIM) manages, controls, and monitors access to privileged roles in Azure AD, not risk-based MFA policies. The question asks for a feature that enforces MFA based on sign-in risk scores, which is handled by Identity Protection, not PIM.
★ When this WOULD be the correct answer
A company needs to provide just-in-time privileged access to Azure AD roles, requiring approval and time-bound activation for administrators. In this scenario, Privileged Identity Management would be the correct feature to configure.
Why candidates choose this
Candidates may confuse PIM's role in securing privileged accounts with risk-based MFA, thinking that managing privileged roles inherently includes risk-based authentication controls.
✗Entitlement ManagementWrong answer — click to see why▾
Why this is wrong here
Entitlement Management is used for managing access packages and identity governance, not for enforcing MFA based on risk signals from sign-in behavior.
★ When this WOULD be the correct answer
An exam scenario where the question asks: 'Which Microsoft Entra ID feature should be used to create and manage access packages for internal and external users to govern access to resources?'
Why candidates choose this
Candidates may confuse Entitlement Management with broader identity protection features, thinking it includes risk-based policies, or they may misassociate 'entitlements' with access controls like MFA.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.