SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company wants to enforce conditional access policies that require multifactor authentication (MFA) for all users accessing financial apps from outside the corporate network. Which Microsoft Entra ID license is minimally required to create conditional access policies?
⚠ Common exam trap
Many candidates confuse Microsoft Entra ID P2 as the minimum because they associate it with advanced security features, but the exam specifically tests that P1 is sufficient for creating conditional access policies without the need for P2's Identity Protection or PIM capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID P1
Microsoft Entra ID P1 (formerly Azure AD Premium P1) is the minimum license required to create and enforce conditional access policies. Conditional access is a premium feature that is not available in Free or Microsoft 365 Business Basic tiers, and while P2 includes additional capabilities like Identity Protection, it is not necessary for basic MFA enforcement based on location.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft 365 Business Basic
Why it's wrong here
Microsoft 365 Business Basic is a comprehensive suite of cloud services that includes Exchange Online, SharePoint Online, Teams, and other productivity tools. While it does bundle the capabilities of Microsoft Entra ID P1, which includes Conditional Access, it is not solely an Entra ID license. The question specifically asks for the *minimal Entra ID license* required, making the broader M365 Business Basic package an overqualified and less precise answer.
- ✗
Microsoft Entra ID P2
Why it's wrong here
Microsoft Entra ID P2 encompasses all the features of P1, including Conditional Access, but also adds advanced capabilities such as Identity Protection and Privileged Identity Management (PIM). Identity Protection offers risk-based Conditional Access policies, detecting and remediating identity-based risks in real-time. Since the requirement is simply to "enforce conditional access policies" without specifying risk-based or PIM features, P2 provides more functionality than strictly necessary, thus not being the *minimal* license.
- ✗
Microsoft Entra ID Free
Why it's wrong here
The Microsoft Entra ID Free tier provides fundamental identity and access management services, including user and group management, single sign-on for up to 10 applications, and basic security reporting. However, advanced security features like Conditional Access, which allows for granular policy enforcement based on various conditions such as user location, device state, or application, are not included in the Free tier. This tier lacks the necessary capabilities to implement the requested policies.
- ✓
Microsoft Entra ID P1
Why this is correct
Microsoft Entra ID P1 is the correct and minimal license required to enforce Conditional Access policies. This license tier enables organizations to define and apply robust access controls, such as requiring multi-factor authentication (MFA) for specific applications, blocking access from untrusted locations, or enforcing device compliance. It provides the essential framework for implementing a strong, adaptive access management strategy.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.