SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Entra ID Protection

  Why it's wrong here

  Microsoft Entra ID Protection is a security module that identifies, reports, and automatically remediates identity-based risks within an organization. It focuses on detecting vulnerabilities like risky sign-ins, compromised credentials, or unusual user behavior, and can enforce policies like requiring MFA or password changes *due to risk*. However, it does not offer a direct self-service mechanism for users to initiate a password reset or account unlock themselves; rather, it reacts to detected risks and might *prompt* a password change as a remediation step.

  When this WOULD be correct

  A question asking which feature should be enabled to automatically block sign-ins from risky IP addresses or detect leaked credentials would make ID Protection the correct answer.

• ✓

  Self-Service Password Reset (SSPR)

  Why this is correct

  Self-Service Password Reset (SSPR) is a core Microsoft Entra ID capability specifically designed to empower end-users to securely reset their forgotten passwords or unlock their own accounts without requiring IT helpdesk intervention. It leverages pre-registered authentication methods, such as mobile app notifications, phone calls, or security questions, to verify the user's identity before allowing the password change or account unlock. This significantly reduces helpdesk calls and improves user productivity by enabling immediate account recovery.

• ✗

  Privileged Identity Management (PIM)

  Why it's wrong here

  Privileged Identity Management (PIM) is a feature within Microsoft Entra ID that focuses on managing, controlling, and monitoring access to *privileged* roles, such as Global Administrator or Exchange Administrator. Its primary function is to provide just-in-time and just-enough access for sensitive roles, requiring activation and often multi-factor authentication. PIM is about securing high-impact administrative access, not enabling general employees to reset their own standard user passwords or unlock their non-privileged accounts.

  When this WOULD be correct

  PIM would be correct if the question asked for a feature that enables just-in-time privileged access, manages role assignments, or provides approval workflows for elevated roles in Microsoft Entra ID.

• ✗

  Conditional Access

  Why it's wrong here

  Conditional Access policies in Microsoft Entra ID are powerful tools used to enforce specific conditions under which users can access resources. These policies evaluate various signals, such as user location, device compliance, or sign-in risk, to determine whether access should be granted, blocked, or require additional authentication like multi-factor authentication. While Conditional Access can *require* a password change as part of a policy, it does not provide the underlying self-service functionality for users to *initiate* a forgotten password reset or account unlock themselves. It's an access control engine, not a self-service identity management feature.

  When this WOULD be correct

  A company wants to require multi-factor authentication (MFA) when users access sensitive applications from untrusted networks, using policies that evaluate conditions like location or device compliance before granting access.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”