Trey Research wants high-risk user accounts (flagged by Microsoft Entra ID Protection due to leaked credentials or anomalous sign-in behavior) to be automatically remediated by forcing an immediate password change. The security team should not need to manually intervene for each incident. What should the admin configure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of the user risk policy as your automatic immune response. When Entra ID Protection spots leaked credentials or impossible-travel behavior and flags an account as High risk, the policy kicks in automatically — next sign-in, the user is required to reset their password via SSPR. No ticket, no waiting, no manual admin work. Clean credentials = risk cleared automatically.
Full explanation below image
Full Explanation
Microsoft Entra ID Protection continuously evaluates user accounts for risk signals including leaked credentials found in breach databases, unfamiliar sign-in properties, atypical travel, and malware-linked IP addresses. The User Risk Policy (configured under Microsoft Entra ID > Security > Identity Protection > User risk policy) allows admins to set a risk level threshold (Low and above, Medium and above, or High) and then define an access control — either Block Access or Allow access and require password change. Setting it to High with 'Require password change' means the system automatically remediates high-risk accounts by forcing a SSPR-based password reset at next sign-in, no admin intervention required. Once the user successfully resets their password, the user risk is automatically dismissed.
Option A (Conditional Access blocking high-risk users) is also available (Conditional Access has a user risk condition when Entra ID P2 is licensed) but 'Block' is overly aggressive — it denies all access, preventing the user from even accessing the SSPR portal to remediate. 'Require password change' via the ID Protection policy (or a Conditional Access policy with the allow + require password change grant) is the proportionate automated remediation control. Note also that 'Defender for Office 365' flags email threats, not user risk — the question conflates two different security products.
Option C (Sentinel + Logic App) is a valid advanced SOAR approach but introduces unnecessary complexity for a scenario where a native automated policy already exists. Sentinel integration is valuable for complex multi-signal investigations and broader incident correlation, but the ID Protection user risk policy provides direct, low-latency automated response without additional tooling.
Option D (revoke PIM assignments) addresses privileged access but does nothing about the compromised account's ability to access regular resources like email, Teams, and SharePoint. The core risk from leaked credentials is unauthorized access to all resources, not just privileged ones.
Exam tip: Microsoft Entra ID Protection requires Microsoft Entra ID P2 licensing. Know the two risk types: User Risk (account compromise indicators) and Sign-in Risk (specific sign-in anomalies). Each has its own configurable policy. User Risk: leaked credentials, anomalous activity patterns. Sign-in Risk: atypical travel, anonymous IP, unfamiliar location.