SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your organization wants to enforce multi-factor authentication (MFA) for all users accessing cloud applications. Which Microsoft Entra ID feature should you configure?
⚠ Common exam trap
SC-900 often tests the difference between Identity Protection (risk detection) and Conditional Access (policy enforcement), tricking candidates who think Identity Protection directly enforces MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Conditional Access policy
Conditional Access policies in Microsoft Entra ID are the recommended way to enforce MFA for all users accessing cloud applications. A Conditional Access policy evaluates signals (user, device, location, app, risk) and can require MFA as a grant control. This provides granular, centralized control and supports reporting and what-if analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Privileged Identity Management
Why it's wrong here
Privileged Identity Management grants just-in-time role activation and approval workflows for privileged directory roles; it does not evaluate sign-in conditions or require a second authentication factor. It is the right choice when governing standing admin access, not when enforcing MFA across all users.
- ✓
Create a Conditional Access policy
Why this is correct
Conditional Access policies evaluate user, device and location signals at sign-in and can require MFA for all users accessing cloud applications, satisfying the stem's enforcement goal. Microsoft Entra ID applies these policies per cloud app, unlike per-user MFA settings that lack application-scoped control.
- ✗
Use Identity Protection
Why it's wrong here
Identity Protection detects risky users and sign-ins and can require MFA only when risk is detected, so it cannot enforce MFA for every user accessing cloud applications. It is the correct choice for risk-based conditional access, not blanket enforcement.
- ✗
Enable MFA per user
Why it's wrong here
Per-user MFA is a legacy toggle that enables MFA for each account individually and cannot be scoped to all users accessing cloud applications through policy. It suits small environments or break-glass accounts, whereas Conditional Access policies enforce MFA at scale.
Go deeper
Related to this question
Learn chapter
Entra Internet Access and Private Access
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.