SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization wants to enable single sign-on (SSO) for users accessing Microsoft 365 apps from unmanaged devices while enforcing multifactor authentication (MFA). Which Microsoft Entra feature should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse Identity Protection (which detects risk) with Conditional Access (which enforces policy), or mistakenly think SSPR or PIM can enforce MFA on unmanaged devices, when only Conditional Access provides the conditional logic to tie device state to authentication requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access
Conditional Access is the correct feature because it allows you to create policies that enforce specific access controls, such as requiring MFA, based on conditions like device state (unmanaged). By combining a device condition (e.g., 'Device is not compliant' or 'Device is unmanaged') with a grant control requiring MFA, you can achieve SSO for users while enforcing MFA on unmanaged devices. This directly addresses the requirement without affecting managed devices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) is a feature that allows users to reset their own forgotten or expired passwords without administrator intervention. While it enhances user productivity and reduces helpdesk calls, SSPR does not inherently enforce Multi-Factor Authentication (MFA) or enable Single Sign-On (SSO) across applications. Its primary function is password management, not access policy enforcement for authentication flows.
- ✓
Conditional Access
Why this is correct
Azure Active Directory Conditional Access is the policy engine that evaluates specific conditions before granting access to resources. It enables organizations to enforce strong authentication requirements, such as Multi-Factor Authentication (MFA), and control access based on factors like user location, device compliance, or application sensitivity. This capability is fundamental for implementing Single Sign-On (SSO) securely by defining the prerequisites for a user's initial authentication and subsequent access to integrated applications.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Azure AD Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources within an organization. It allows for just-in-time and just-enough access for privileged roles, reducing the risk of excessive or standing administrative permissions. However, PIM's core function is elevating and securing *privileged* role assignments, not establishing or enforcing general Single Sign-On (SSO) or Multi-Factor Authentication (MFA) policies for all users accessing everyday applications.
- ✗
Identity Protection
Why it's wrong here
Azure AD Identity Protection is a tool that helps organizations detect, investigate, and remediate identity-based risks. It identifies potential vulnerabilities affecting identities, such as leaked credentials or anomalous sign-in behaviors, and can automatically respond to these threats. While Identity Protection can trigger actions like requiring Multi-Factor Authentication (MFA) or password changes in response to a detected risk, it is a risk detection and remediation service, not the direct policy engine for enforcing Single Sign-On (SSO) or general MFA requirements.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.