Describe the capabilities of Microsoft security solutions →easyMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

⚠ Common exam trap

A common mix-up: candidates confuse Identity Protection's risk-based policies with location-based blocking, but Identity Protection focuses on user and sign-in risk (e.g., impossible travel, anonymous IP) rather than static geographic restrictions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Conditional Access with Named Locations

Conditional Access with Named Locations allows you to define geographic locations (e.g., countries) and then create a policy that blocks sign-ins from locations that are not approved for business operations. This is the correct feature because it directly enforces access controls based on the user's physical location at the time of authentication, using IP address ranges or country/region mapping.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and just-enough-administration (JEA) access to privileged roles. It requires users to activate roles, often with multi-factor authentication or approval workflows, for a limited time. PIM's core function is to mitigate the risks associated with excessive, unnecessary, or misused access permissions, but it does not offer a mechanism to block sign-ins based on geographic location.
✗
Terms of Use
Why it's wrong here
Microsoft Entra Terms of Use policies are utilized to present information to users and require their explicit acceptance before they can access specific applications or resources. This ensures users acknowledge and agree to organizational policies, legal disclaimers, or compliance mandates. While they can gate access, their purpose is to obtain user consent and track acceptance, not to enforce location-based access restrictions or proactively block sign-ins from particular countries.
✓
Conditional Access with Named Locations
Why this is correct
Microsoft Entra Conditional Access policies are the primary tool for implementing granular access controls based on various signals, including user, device, application, and crucially, location. By configuring "Named Locations" to define specific IP address ranges or countries, an organization can create a Conditional Access policy to explicitly block or allow sign-ins from those defined geographic areas. This directly addresses the requirement to prevent access from specific countries by denying authentication attempts originating from those regions.
✗
Identity Protection user risk policy
Why it's wrong here
Microsoft Entra ID Protection is a security module focused on detecting, investigating, and remediating identity-based risks, such as leaked credentials, impossible travel, or sign-ins from unfamiliar locations. While it can identify suspicious sign-ins that might originate from unusual geographies, its policies are designed to respond to detected risks (e.g., requiring MFA, password change, or blocking access temporarily) rather than proactively blocking all sign-ins from a predefined, static geographic region. It's a reactive risk mitigation tool, not a static geographic access control.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Why each option matters

Option-by-option breakdown

Related to this question