SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your company uses Microsoft Entra ID. You need to ensure that when a user's account is compromised and used to send spam, the account is automatically blocked from signing in. Which feature should you configure?
⚠ Common exam trap
Many candidates confuse Conditional Access policies with Identity Protection user risk policies, but the question specifically asks for the feature that automatically blocks based on compromise (spam), which is the user risk policy in Identity Protection, not a general Conditional Access policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Identity Protection with a user risk policy to block high-risk users
Microsoft Entra Identity Protection uses machine learning to detect user risk, such as when an account is compromised and used to send spam. A user risk policy can be configured to automatically block sign-ins for high-risk users, directly addressing the requirement to block the compromised account from signing in.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Conditional Access policy to block sign-ins from high-risk users
Why it's wrong here
Microsoft Entra Conditional Access policies are powerful enforcement tools that define *how* users access resources based on conditions like location, device, or application. However, Conditional Access policies themselves do not perform the underlying risk detection. To block sign-ins from high-risk users, a Conditional Access policy *must* integrate with Microsoft Entra Identity Protection, which provides the actual risk signals (user risk, sign-in risk) that the policy then uses as a condition for blocking access. Without Identity Protection, Conditional Access lacks the intelligence to identify "high-risk users."
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) manages just-in-time role activation and approval workflows for privileged roles, not sign-in risk responses. It fails this scenario because it lacks any mechanism to detect anomalous behaviour like spam-sending or to enforce a conditional access block on the user’s authentication session. PIM is tempting because it deals with account security and access control, and would be the correct choice if the requirement were to limit standing administrative privileges or require approval for role elevation.
- ✓
Microsoft Entra Identity Protection with a user risk policy to block high-risk users
Why this is correct
Microsoft Entra Identity Protection is the dedicated service for detecting, investigating, and remediating identity-based risks. A user risk policy within Identity Protection continuously monitors for suspicious activities, such as leaked credentials or impossible travel, to calculate a user's aggregate risk level. When this risk level crosses a configured threshold, the policy can be set to automatically block the user's sign-in attempt, directly fulfilling the requirement to prevent high-risk users from accessing resources.
- ✗
Microsoft Entra Self-Service Password Reset
Why it's wrong here
Microsoft Entra Self-Service Password Reset (SSPR) is a feature that allows users to reset their own passwords without requiring administrator assistance. Its primary purpose is to improve user productivity and reduce help desk calls related to password resets. While SSPR can be a remediation action *triggered* by Identity Protection for risky users, it does not independently detect high-risk sign-ins or proactively block compromised accounts based on real-time risk signals.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.