SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Identity Protection

  Why it's wrong here

  Azure AD Identity Protection is a security feature designed to detect, investigate, and remediate identity-based risks. It analyzes sign-in attempts and user behavior to identify anomalies like leaked credentials or suspicious locations, then enforces automated responses such as blocking access or requiring multi-factor authentication. Its purpose is risk mitigation and security posture improvement, not to establish the underlying mechanism for single sign-on.

• ✗

  Conditional Access

  Why it's wrong here

  Conditional Access policies in Azure AD define 'if-then' rules to control access to resources based on specific conditions like user location, device state, or sign-in risk. While it can enforce strong authentication or restrict access, it acts as an enforcement layer *after* an identity has been established or is attempting to be established. It does not provide the foundational framework for a user to authenticate once and gain seamless access to multiple, distinct applications without re-entering credentials.

• ✓

  Federation

  Why this is correct

  Federation establishes a trust relationship between an identity provider (IdP) and one or more service providers (SPs), enabling users to authenticate once with the IdP and gain access to multiple SPs without re-entering credentials. This mechanism, often leveraging protocols like SAML or OpenID Connect, allows the IdP to assert a user's identity to various applications. It is the core technology that facilitates single sign-on (SSO) across different applications and organizational boundaries.

• ✗

  Privileged Identity Management

  Why it's wrong here

  Azure AD Privileged Identity Management (PIM) is a service focused on managing, controlling, and monitoring access to highly privileged roles and resources within Azure AD and Azure. It provides just-in-time (JIT) access, requiring users to activate roles for a limited time and often with multi-factor authentication, to minimize the attack surface of standing administrative permissions. PIM's primary function is securing and auditing elevated access, not providing a general single sign-on experience for all users across standard business applications.

Go deeper

Related to this question