SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Correct answer & explanation

Security defaults are a pre-configured set of security policies that include MFA based on risk, specifically prompting for MFA when users sign in from unfamiliar locations or devices, and are available without additional licensing. Option A is incorrect because while Conditional Access policies are available with Microsoft 365 Business Premium (which includes Microsoft Entra ID P1), a simple policy requiring MFA for *all* cloud apps would prompt for MFA every time, not specifically when signing in from unfamiliar locations or devices. To achieve risk-based MFA with Conditional Access that specifically targets unfamiliar locations/devices, more advanced configurations or potentially Microsoft Entra ID P2 features (for advanced sign-in risk detection) might be needed, which would go against the 'easy to deploy' and 'no additional licensing' constraints if P2 is implied. Security defaults provide this risk-based MFA out-of-the-box without complex configuration or P2 licensing. Option C is incorrect because deploying the Microsoft Authenticator app alone does not enforce MFA; a policy such as security defaults or conditional access is needed to prompt for MFA based on location or device. Option D is incorrect because identity protection risk-based MFA requires Azure AD Premium P2 licensing, which is not included in Business Premium.