SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization requires that all external guest users must sign in using Microsoft Authenticator for MFA. What should you configure?
⚠ Common exam trap
Many candidates confuse the high-level B2B collaboration settings (which only control trust of MFA from the home tenant) with the ability to enforce a specific MFA method directly on guest users, which requires a Conditional Access policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access policy
A Conditional Access policy is the correct choice because it allows you to enforce MFA requirements for specific users, including external guest users, based on conditions such as sign-in risk, location, or device state. By targeting the 'Guest or external users' directory role in a Conditional Access policy, you can require Microsoft Authenticator as the MFA method, overriding default settings. This provides granular control over authentication behavior for B2B collaboration guests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Conditional Access policy
Why this is correct
A Conditional Access policy is the definitive control plane in Microsoft Entra ID for enforcing specific access requirements, such as multi-factor authentication (MFA), based on various conditions. By targeting 'All guest and external users' and requiring MFA, organizations can ensure that all external collaborators must satisfy this strong authentication method before accessing resources, regardless of their home tenant's policies. This provides a robust security posture for external access by integrating MFA directly into the sign-in flow.
- ✗
Microsoft Entra B2B collaboration settings
Why it's wrong here
Microsoft Entra B2B collaboration settings primarily govern the invitation process and the management of external identities within a tenant. These settings control aspects like who can invite guests, which domains are allowed or denied for collaboration, and self-service sign-up experiences. However, they do not provide mechanisms to enforce specific authentication methods, like requiring multi-factor authentication, for guest users once they attempt to sign in to resources.
- ✗
Access reviews
Why it's wrong here
Access reviews are a governance feature designed to periodically verify and certify who has access to specific resources, groups, or applications. Their purpose is to ensure that access rights remain appropriate and are promptly removed when no longer needed, helping to mitigate stale access. While crucial for maintaining a least-privilege posture, access reviews do not enforce authentication requirements, such as multi-factor authentication, during a user's sign-in attempt.
- ✗
ID Protection policies
Why it's wrong here
Microsoft Entra ID Protection policies are focused on detecting and remediating identity-based risks, such as compromised credentials, impossible travel, or infected devices. These policies can trigger actions like requiring a password change or an MFA challenge *in response to a detected risk*. However, they are not designed to establish a baseline requirement for multi-factor authentication for all guest users proactively, as their primary function is risk detection and remediation, not blanket access control.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.