SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Identity Protection

  Why it's wrong here

  Azure AD Identity Protection is a tool that automates the detection and remediation of identity-based risks, such as leaked credentials, impossible travel, or unfamiliar sign-in properties. While it identifies suspicious activities and calculates a risk level for users and sign-ins, it does not directly enforce access controls like requiring MFA based on network location. Instead, Identity Protection generates risk signals that can then be consumed by Conditional Access policies to trigger appropriate actions, including MFA challenges.

  When this WOULD be correct

  Identity Protection would be correct if the question asked: 'Which Microsoft Entra ID feature should be used to detect and automatically respond to risky sign-in behaviors, such as sign-ins from anonymous IP addresses or leaked credentials?'

• ✓

  Conditional Access

  Why this is correct

  Conditional Access policies evaluate various signals in real-time, including user, device, application, and network location. Administrators can configure these policies to mandate specific controls, such as multi-factor authentication (MFA), when certain conditions are met, like a user attempting to access resources from an untrusted network or outside the corporate IP range. This directly addresses the requirement to enforce MFA for users accessing resources under specific conditions.

• ✗

  Privileged Identity Management (PIM)

  Why it's wrong here

  Azure AD Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within an organization. It focuses on providing just-in-time and just-enough access to privileged roles, requiring activation and often MFA during role activation. However, PIM's scope is limited to managing elevated role assignments and does not provide the capability to enforce general MFA requirements for all users accessing resources based on conditions like network location.

  When this WOULD be correct

  A company needs to provide just-in-time privileged access to Azure AD roles and require approval or MFA for role activation. In that scenario, PIM is the correct feature to use.

• ✗

  Self-Service Password Reset (SSPR)

  Why it's wrong here

  Self-Service Password Reset (SSPR) is a feature that empowers users to reset their forgotten or locked passwords independently, without requiring help desk assistance. While SSPR can be configured to require MFA during the password reset process, its primary function is password management, not enforcing MFA for general access to applications or resources based on conditions like network location. It does not govern access policies.

  When this WOULD be correct

  A company wants to allow users to reset their own passwords securely by verifying their identity through a second factor, such as a phone call or text message. Which Microsoft Entra ID feature should be used?

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”