Microsoft Entra ID Identity Protection Features
Which THREE are features of Microsoft Entra ID Protection? (Choose THREE.)
Quick Answer
The answer is risk-based conditional access, sign-in risk detection, and user risk remediation. Sign-in risk detection is a core feature of Microsoft Entra ID Identity Protection, using real-time and offline machine learning to evaluate each sign-in for anomalies like impossible travel or anonymous IP addresses, assigning a low, medium, or high risk level to trigger automated responses. On the SC-900 exam, this topic tests your understanding of how Identity Protection integrates with Conditional Access to block or challenge risky sign-ins before compromise occurs. A common trap is confusing Identity Protection’s risk detection with general Azure AD logs—remember that Identity Protection specifically assigns risk levels and enables automated policies. For a memory tip, think “R.U.S.H.”: Risk detection, User risk, Sign-in risk, and Hybrid (cloud-only) integration, all key to mastering these features.
⚠ Common exam trap
Many exam-takers confuse Entra ID Protection (focused on risk detection and remediation) with Entra ID Governance (focused on identity lifecycle and access controls), leading them to select Privileged role management or Identity governance as features of ID Protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sign-in risk detection
Sign-in risk detection is a core feature of Microsoft Entra ID Protection. It uses real-time and offline machine learning models to evaluate each sign-in attempt for anomalies such as impossible travel, anonymous IP addresses, or atypical locations, assigning a risk level (low, medium, high). This allows organizations to automatically respond to suspicious sign-ins before compromise occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Privileged role management
Why it's wrong here
Privileged role management is a feature of Privileged Identity Management.
- ✓
Sign-in risk detection
Why this is correct
Identity Protection detects risky sign-ins such as from anonymous IP addresses.
- ✓
Detection of leaked credentials
Why this is correct
Identity Protection detects credentials that have been exposed in public breaches.
- ✓
Risk-based conditional access
Why this is correct
Identity Protection can enforce conditional access based on user risk.
- ✗
Identity governance
Why it's wrong here
Identity governance is a separate set of capabilities in Microsoft Entra.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO features are included in Microsoft Entra ID Identity Protection? (Choose two.)
medium- A.Just-in-time privileged access
- ✓ B.Sign-in risk detection
- C.Cloud app discovery
- D.Multi-factor authentication registration campaign
- ✓ E.User risk detection
Why B: Microsoft Entra ID Identity Protection includes sign-in risk detection (B) and user risk detection (E) as its two core risk detection capabilities. Multi-factor authentication registration campaign is a separate Microsoft Entra authentication methods feature, not a feature of Identity Protection. Identity Protection has an MFA registration policy, which is different from a registration campaign. Therefore, the correct features are B and E.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.