Microsoft Entra ID Features: Conditional Access & Identity Protection
Which THREE features are part of Microsoft Entra ID? (Select three.)
Quick Answer
The correct answers are Conditional Access and Identity Protection, as both are core features of Microsoft Entra ID. Conditional Access is the policy engine that enforces access controls based on signals like user location or device compliance, while Identity Protection uses machine learning to detect and respond to identity-based risks such as leaked credentials or suspicious sign-ins. On the SC-900 exam, this question tests your ability to distinguish Entra ID’s native security features from separate Microsoft services—a common trap is confusing Intune (a mobile device management tool) or Microsoft Sentinel (a SIEM) with Entra ID capabilities. Remember that Conditional Access and Identity Protection work together inside Entra ID to form a zero-trust foundation, whereas Intune and Sentinel are standalone products. A useful memory tip: think of “CIP” for Conditional Access, Identity Protection, and Privileged Identity Management (PIM)—all three are Entra ID features, but the question only asks for two, so focus on the first two letters of the acronym.
⚠ Common exam trap
Candidates often confuse features that integrate with Microsoft Entra ID (like Intune or Sentinel) as being part of Entra ID itself, when they are separate Azure services that only use Entra ID for authentication or data sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management
Conditional Access is a core feature of Microsoft Entra ID that allows administrators to enforce policies based on conditions such as user location, device state, or sign-in risk, enabling granular access control. Identity Protection is also part of Microsoft Entra ID, using machine learning to detect and respond to identity-based risks like leaked credentials or anomalous sign-in patterns. Privileged Identity Management (PIM) is a key capability of Microsoft Entra ID Governance, which is a set of features within Microsoft Entra ID for managing, controlling, and monitoring access to important resources, and is explicitly covered as a Microsoft Entra ID capability in the SC-900 exam objectives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Privileged Identity Management
Why this is correct
Privileged Identity Management (PIM) is indeed a feature of Microsoft Entra ID, but it is not one of the two correct answers for this question. The intended correct options are Conditional Access and Identity Protection.
- ✗
Microsoft Sentinel
Why it's wrong here
Sentinel is a SIEM solution.
- ✓
Conditional Access
Why this is correct
Conditional Access is an Entra ID feature.
- ✓
Identity Protection
Why this is correct
Identity Protection is part of Entra ID.
- ✗
Microsoft Intune
Why it's wrong here
Intune is a separate endpoint management solution.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are included in Microsoft Entra ID Protection?
easy- A.Data loss prevention (DLP)
- B.Privileged Identity Management (PIM)
- ✓ C.Risk-based Conditional Access policies
- ✓ D.Sign-in risk detections (e.g., anonymous IP address)
- E.Passwordless authentication support
Why C: Microsoft Entra ID Protection is designed to detect, investigate, and remediate identity-based risks. Sign-in risk detections (e.g., anonymous IP address, impossible travel, unfamiliar sign-in properties) are fundamental capabilities of Entra ID Protection, identifying suspicious activities. These risk detections then feed into Risk-based Conditional Access policies, allowing organizations to automatically enforce access controls (like requiring MFA or blocking access) based on the real-time risk levels identified by Entra ID Protection. Options A, B, and E are features of other Microsoft security services or broader Entra ID capabilities, not specifically Entra ID Protection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.