A security engineer reviews Microsoft Entra ID Protection and sees multiple 'Anonymous IP address' sign-in risk detections for a service account used by an on-premises application for API calls. What is the most likely cause and appropriate remediation?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because 'Anonymous IP address' detections on service accounts often indicate that the application's outbound IP is categorized as anonymous (VPN, proxy, hosting provider) in Microsoft's threat intelligence. Adding the legitimate IP to a named location in Entra ID marks it as trusted and prevents false positive risk detections.
Full explanation below image
Full Explanation
B is correct because 'Anonymous IP address' detections on service accounts often indicate that the application's outbound IP is categorized as anonymous (VPN, proxy, hosting provider) in Microsoft's threat intelligence. Adding the legitimate IP to a named location in Entra ID marks it as trusted and prevents false positive risk detections. A is incorrect because service accounts with consistent anonymous IP detections from a single source are more likely a false positive from network egress configuration. C is incorrect because Entra Connect sync agents would not cause IP-based risk detections on a separate service account. D is incorrect because service accounts typically cannot complete MFA and the detection is not related to MFA registration.