SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company uses Microsoft Entra ID. You need to enforce that all users register for MFA within 14 days of account creation. Which feature should you use?
⚠ Common exam trap
A common mix-up: candidates confuse Conditional Access (which enforces MFA at sign-in) with the registration campaign (which enforces the initial MFA setup process), not realizing that Conditional Access cannot force a user to register within a specific number of days—it only blocks access if MFA is absent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MFA registration campaign
The MFA registration campaign is specifically designed to nudge users to register for MFA within a configurable time frame after account creation. It sends targeted notifications and enforces registration by blocking access until the user completes MFA setup, directly meeting the 14-day requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection primarily focuses on detecting and remediating identity-based risks, such as compromised credentials or unusual sign-in patterns. While it can enforce MFA as a remediation action for risky sign-ins, its functionality does not include scheduling or managing proactive campaigns to compel users to register their MFA methods within a specified timeframe. Its role is reactive to risk, not proactive enrollment management.
- ✓
MFA registration campaign
Why this is correct
The Microsoft Entra ID MFA registration campaign policy is specifically designed to drive user adoption of multi-factor authentication by actively prompting users to register their MFA methods. This feature allows administrators to configure a grace period, expressed as a specific number of days, during which users are repeatedly prompted to register before MFA becomes mandatory for all sign-ins. It directly addresses the need to enforce registration within a customizable, set number of days.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies in Microsoft Entra ID are powerful tools for enforcing access controls based on various conditions, including requiring multi-factor authentication during a sign-in attempt. However, these policies do not inherently manage or schedule the initial registration process for MFA methods across a user population within a defined timeframe. While a Conditional Access policy requiring MFA might indirectly prompt an unregistered user to register during a sign-in, it does not provide a campaign mechanism or a configurable deadline for initial enrollment.
- ✗
Security defaults
Why it's wrong here
Microsoft Entra ID Security defaults provide a baseline level of security for all tenants, including enforcing multi-factor authentication registration for all users. While they do mandate MFA registration, they come with a fixed, non-customizable 14-day grace period for users to complete their registration. If the requirement is to enforce MFA registration within a *customizable* or *specific* number of days different from the default 14, Security defaults are not flexible enough to meet that precise administrative need.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.