2.3. Core Security Features and Identity
š” First Principle: Microsoft Entra ID is the identity backbone of Microsoft 365 ā every user, every app, every policy evaluation starts with Entra. The security features built on top of it (Conditional Access, SSO, PIM) are tools for answering one question precisely: should this person, on this device, from this context, be allowed to access this resource right now?
Getting identity security right is the highest-leverage thing an M365 admin can do.
Think of Entra ID as the security checkpoint for every M365 resource. Every request ā "open this email," "access this SharePoint site," "launch this app" ā flows through Entra's evaluation: Who are you? What device are you on? What Conditional Access policies apply? What's your risk score? The answer determines access.
| Entra ID Capability | What It Solves | When It Matters |
|---|---|---|
| Conditional Access | Context-aware access decisions | Block unmanaged devices, require MFA in risky contexts |
| PIM | Just-in-time privileged access | Reduce standing admin exposure |
| SSO | One login for all connected apps | User convenience + centralized session control |
| Identity Protection | Risk-based sign-in evaluation | Detect stolen credentials, impossible travel |
ā ļø Exam Trap: Conditional Access policies evaluate at sign-in time ā they don't continuously monitor sessions. A session that passes the CA check at login won't be re-evaluated mid-session unless token lifetime policies are configured. One misconfigured Conditional Access policy can lock out your entire organization. One over-permissioned app registration can expose sensitive data. This section covers the tools and the mental models needed to configure them correctly.
The exam tests this domain heavily ā expect questions about what Conditional Access can evaluate, what PIM does, and the difference between app registrations and enterprise apps.
ā ļø Common Misconception: Conditional Access is a lockout tool ā it only blocks access. In reality, Conditional Access is a policy engine that can grant access, grant with conditions (require MFA, require compliant device), or block. It enables access as much as it restricts it.
