SC-900 Microsoft Entra explained
The Microsoft Entra skill area is worth 25–30% of SC-900, the second largest. It covers what Microsoft Entra ID is and the identity types it holds, how users authenticate (methods, MFA, password protection), how access is controlled (Conditional Access, roles and RBAC), and how identities are protected and governed (ID Protection, Privileged Identity Management, access reviews and ID Governance). Most questions ask which feature meets a given requirement.
Microsoft Entra ID and identity types
Microsoft Entra ID is Microsoft’s cloud identity and access management service, used to sign in to Microsoft 365, Azure and thousands of other apps. It holds several identity types: users, groups, devices and workload identities (identities for applications and services rather than people, such as service principals and managed identities). External identities allow partners and customers to access resources.
Hybrid identity means on-premises Active Directory accounts are synchronized to Entra ID, so users have one identity across both. Sign-in can use password hash synchronization, pass-through authentication or federation.
Authentication capabilities
- Methods: passwords, the Microsoft Authenticator app, FIDO2 security keys, Windows Hello for Business, SMS and voice calls, and passwordless options.
- Multifactor authentication (MFA) requires two or more of: something you know, something you have, something you are. It blocks the vast majority of password-based attacks.
- Password protection and management: banned password lists block common or weak passwords, and self-service password reset lets users recover accounts without the help desk.
Access management
| Feature | What it does |
|---|---|
| Conditional Access | If-then policies: when signals such as user, location, device or risk match, require MFA, block access or require a compliant device |
| Entra roles | Administrative roles for managing Entra itself, such as Global Administrator or User Administrator |
| Role-based access control (RBAC) | Grants permissions by role at a defined scope, following least privilege |
Conditional Access is the policy engine behind Zero Trust sign-in decisions. Know that it does not authenticate users; it decides what is required after the first factor.
Identity protection and governance
- Microsoft Entra ID Protection detects risky users and risky sign-ins (for example, from anonymous IP addresses or leaked credentials) and can automate responses, such as forcing a password change.
- Privileged Identity Management (PIM) provides just-in-time, time-limited and approval-based activation of privileged roles.
- Access reviews let owners or reviewers periodically confirm that users still need their access.
- Microsoft Entra ID Governance covers lifecycle tasks such as entitlement management, access packages, access reviews and lifecycle workflows for joiners, movers and leavers.
Example questions
Question 1. A company wants administrators to hold the Global Administrator role only when they need it, for a limited time, with an approval step and a record of activations. Which feature should it use?
- A. Conditional Access
- B. Microsoft Entra ID Protection
- C. Password protection
- D. Privileged Identity Management
Show answer
Answer: D
Privileged Identity Management provides just-in-time, time-bound and approval-based activation of privileged roles with auditing. Conditional Access controls sign-in conditions, not role activation. ID Protection detects risk. Password protection blocks weak passwords.
Want more questions like this? Full SC-900 practice tests →
Question 2. A user signs in from an unfamiliar country using an IP address associated with anonymous browsing, and a risk-based policy forces a password change. Which service produced the risk signal?
- A. Access reviews
- B. Microsoft Entra ID Protection
- C. Entitlement management
- D. Microsoft Entra Connect synchronization
Show answer
Answer: B
Microsoft Entra ID Protection detects risky sign-ins and risky users and feeds those signals into policies. Access reviews recertify access on a schedule. Entitlement management bundles access packages. Hybrid identity synchronization copies accounts from on-premises and does not score sign-in risk.
Want more questions like this? Full SC-900 practice tests →
Question 3. An organization uses a mix of on-premises Active Directory and Microsoft 365 and wants users to have one identity for both. What is this called?
- A. Hybrid identity
- B. A workload identity
- C. A guest account
- D. Passwordless sign-in
Show answer
Answer: A
Hybrid identity synchronizes on-premises accounts with Microsoft Entra ID so one identity works in both places. A workload identity belongs to an application, not a person. A guest account is for external users. Passwordless sign-in is an authentication method, not an identity model.
Want more questions like this? Full SC-900 practice tests →
Next, the largest area: Microsoft security solutions explained.