Microsoft Entra ID Protection reports a 'Leaked credentials' risk detection for a user account. The organization has a Conditional Access policy that requires MFA for medium and high user risk. The compromised user successfully authenticates with MFA and continues working. What additional remediation step should the security team take?

A is correct because when leaked credentials are confirmed, the password is known to be compromised. Resetting the password and revoking all refresh tokens (which invalidates all existing sessions and tokens) is the proper remediation to evict the attacker and dismiss the risk detection. B is incorrect because blocking the user is overly disruptive and indefinite; credential remediation is the correct approach, not permanent blocking. C is incorrect because re-registering MFA methods does not address the leaked password, which is the compromised credential. D is incorrect because Insider Risk Management is for behavior monitoring, not immediate incident remediation of a credential compromise.