Municipal HR and payroll want a prioritized identity improvement backlog before expanding Copilot. Which Microsoft Entra concept fits?

Municipal HR and payroll preparing a prioritized identity improvement backlog before expanding Copilot should use Identity Secure Score recommendations that highlight identity hardening priorities. Identity Secure Score surfaces actionable items (MFA coverage, legacy authentication, privileged role hygiene, and related controls) ranked to improve posture. That backlog is especially relevant before Copilot expands access to organizational content under user identities.

Purview Compliance Manager recommendations that prioritize data compliance improvements focus on regulatory and data protection controls against compliance requirements, a different domain than Identity Secure Score's identity hardening priorities, so they would not deliver the prioritized identity backlog HR and payroll need. Conditional Access policies that enforce contextual sign-in access controls are the enforcement mechanisms themselves that grant or block access based on conditions, not a ranked list of which identity improvements to do next, so they do not substitute for Identity Secure Score recommendations as the prioritized backlog. Secure Score recommendations that track general tenant security posture cover security configuration broadly across the tenant including endpoints, apps and data, not the ranked identity-specific hardening priorities that make up the actionable identity backlog itself.

Exam caveat: Distinguish Identity Secure Score recommendations (prioritized identity backlog) from Secure Score general recommendations, Purview Compliance Manager compliance recommendations, and Conditional Access enforcement policies. AB-900 expects you to choose Identity Secure Score for ranked identity hardening work, not Secure Score general posture tracking, Compliance Manager compliance improvements, or Conditional Access enforcement alone.

Operational check: In the Microsoft 365 admin / Entra Identity Secure Score experience, export or review open recommendations affecting HR and payroll identities, prioritize MFA, Conditional Access, and privileged access items before Copilot rollout, assign owners and due dates, and re-measure score after each remediation wave.