A building inspections finance clerk traveling abroad triggers a risky sign-in flag. Which review focus fits?

A building inspections finance clerk traveling abroad who triggers a risky sign-in flag should drive investigation of the risky sign-in signals and related identity protection alerts for that account. Microsoft Entra Identity Protection (and related risky sign-in views) score unfamiliar travel, unfamiliar features, malware-linked IPs, and similar anomalies so municipal IT can confirm, dismiss, or remediate risk without destroying productivity systems.

Investigating the risky sign-in signals and related authentication methods registration for that account focuses on MFA registration details rather than the identity protection alerts needed to confirm or dismiss risk, so you might note the travel event while missing correlated detections like malware-linked IPs or unfamiliar features. Investigating the risky sign-in signals and related privileged role assignment history for that account misdirects a standard user travel review toward administrator role changes, which does not help confirm the risk detections for a finance clerk and could delay password reset or session revoke if compromise is real. Investigating the risky sign-in signals and related named location policy history for that account centers on past location policy edits rather than the current identity protection alerts, so you might understand policy context but still miss whether the sign-in itself is compromised.

Exam caveat: Risky sign-in review is an identity-protection workflow—investigate signals, confirm user travel if legitimate, reset credentials or require password reset/MFA re-registration when risk is confirmed. Distractors that suggest investigating the risky sign-in signals and related authentication methods registration, privileged role assignment history, or named location policy history are wrong; the primary focus must be the risky sign-in signals and identity protection alerts.

Operational check: In Entra Identity Protection / risky sign-ins, open the clerk’s event, review risk detections and location/IP details against known travel, contact the clerk through an out-of-band channel, mark risk confirmed or dismissed per city procedure, enforce any required password reset or session revoke, and keep audit logging enabled throughout.