Microsoft Entra ID Identity Protection Features
Which THREE are features of Microsoft Entra ID Protection? (Choose THREE.)
Quick Answer
The answer is risk-based conditional access, sign-in risk detection, and user risk remediation. Sign-in risk detection is a core feature of Microsoft Entra ID Identity Protection, using real-time and offline machine learning to evaluate each sign-in for anomalies like impossible travel or anonymous IP addresses, assigning a low, medium, or high risk level to trigger automated responses. On the SC-900 exam, this topic tests your understanding of how Identity Protection integrates with Conditional Access to block or challenge risky sign-ins before compromise occurs. A common trap is confusing Identity Protection’s risk detection with general Azure AD logs—remember that Identity Protection specifically assigns risk levels and enables automated policies. For a memory tip, think “R.U.S.H.”: Risk detection, User risk, Sign-in risk, and Hybrid (cloud-only) integration, all key to mastering these features.
⚠ Common exam trap
Many exam-takers confuse Entra ID Protection (focused on risk detection and remediation) with Entra ID Governance (focused on identity lifecycle and access controls), leading them to select Privileged role management or Identity governance as features of ID Protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign-in risk detection
Microsoft Entra ID Protection is specifically designed to detect, investigate, and remediate identity-based risks, so option B (Sign-in risk detection) is correct because it evaluates each sign-in attempt in real time and flags events such as anonymous IP usage, atypical travel, or malware-linked IP addresses as low, medium, or high risk. Option C (Detection of leaked credentials) is correct because ID Protection scans for compromised username/password pairs exposed on the dark web or paste sites and surfaces them as 'leaked credentials' user-risk detections. Option D (Risk-based conditional access) is correct because ID Protection feeds its sign-in risk and user risk signals into Conditional Access policies, allowing administrators to require MFA, password change, or block access when risk is elevated. Option A (Privileged role management) is not a feature of ID Protection; privileged identity management is delivered by Microsoft Entra Privileged Identity Management (PIM), which handles just-in-time role activation and approvals. Option E (Identity governance) is also not part of ID Protection; identity governance capabilities such as access reviews, entitlement management, and lifecycle workflows belong to Microsoft Entra ID Governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Privileged role management
Why it's wrong here
Privileged role management belongs to Microsoft Entra Privileged Identity Management, which handles just-in-time role activation and approval; Entra ID Protection instead surfaces sign-in and user risk detections. It is tempting because both reduce identity compromise, and PIM would be correct when the requirement is time-bound, approval-gated elevation of directory roles.
- ✓
Sign-in risk detection
Why this is correct
Sign-in risk detection evaluates each authentication attempt using signals like anonymous IP use, atypical travel and unfamiliar sign-in properties, then assigns a risk level. This gives Microsoft Entra ID Protection the per-session risk signal that Conditional Access policies consume to challenge or block suspicious sign-ins.
- ✓
Detection of leaked credentials
Why this is correct
Leaked credential detection matches Microsoft Entra ID accounts against compromised username and password pairs found by Microsoft's threat intelligence, then raises user risk. This satisfies the identity-risk requirement by surfacing credentials already exposed, prompting remediation such as password reset or risk-based Conditional Access enforcement.
- ✓
Risk-based conditional access
Why this is correct
Sign-in and user risk detections from Microsoft Entra ID Protection feed directly into Conditional Access as conditions, so policies can block or challenge sessions when risk is elevated. This satisfies the requirement for automated, risk-triggered enforcement rather than static rule-based access.
- ✗
Identity governance
Why it's wrong here
Identity governance handles access reviews, entitlement management and lifecycle workflows; it sits outside Entra ID Protection, which detects and remediates identity risk through sign-in and user risk policies. It is tempting because both concern identity security, and governance would be the correct choice when the requirement is periodic access certification rather than risk-based conditional access.
Go deeper
Related to this question
Learn chapter
Defender Vulnerability Management Basics
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Identity Governance
Identity Governance is the policy-based framework that ensures the right people have the right access to the right resources at the right time, with oversight and control.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO features are included in Microsoft Entra ID Identity Protection? (Choose two.)
medium- A.Just-in-time privileged access
- ✓ B.Sign-in risk detection
- C.Cloud app discovery
- D.Multi-factor authentication registration campaign
- ✓ E.User risk detection
Why B: Microsoft Entra ID Identity Protection is built around two risk signal types: sign-in risk detection (Option B) and user risk detection (Option E). Sign-in risk detection evaluates each authentication attempt in real time using signals such as anonymous IP address, atypical travel, malware-linked IP address, and unfamiliar sign-in properties, and it can trigger Conditional Access policies requiring MFA or blocking access. User risk detection identifies accounts whose credentials are likely compromised, for example through leaked credentials found on the dark web or by detecting anomalous user activity, and it drives remediation such as forced password reset. Option A (just-in-time privileged access) belongs to Microsoft Entra Privileged Identity Management, not Identity Protection. Option C (Cloud app discovery) is a Microsoft Defender for Cloud Apps capability used to discover and assess shadow IT SaaS usage. Option D (multi-factor authentication registration campaign) is an authentication methods policy setting in Microsoft Entra ID that nudges users to register for MFA; it is not one of the risk detections provided by Identity Protection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.