Microsoft 365 Certified Endpoint Administrator (MD-102) Practice Test

To protect user identities within Azure AD, which feature should be enabled?

1. Single sign-on (SSO)

2. Multi-Factor Authentication (MFA)

3. Conditional Access

4. Privileged Identity Management (PIM)

The correct answer is: Conditional Access

Enabling Conditional Access is the most effective way to protect user identities within Azure Active Directory (Azure AD). This feature allows organizations to enforce policies that determine how and when users can access resources. By applying conditions such as user location, device state, and application sensitivity, organizations can tailor access permissions dynamically. For example, Conditional Access policies can require additional authentication when users try to access sensitive information from an unfamiliar location or device, thereby enhancing security. This feature also integrates seamlessly with other security measures like Multi-Factor Authentication, making it a comprehensive approach to safeguarding user identities. While Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Privileged Identity Management (PIM) are indeed important for identity and access management, they serve different purposes. SSO simplifies the user experience by allowing one set of credentials for multiple applications, while MFA adds an additional layer of security by requiring a second form of verification. PIM specifically focuses on managing and controlling privileged accounts within Azure AD. However, Conditional Access goes further by providing a broader framework for access management, making it the best choice for protecting user identities.