Microsoft Entra ID Protection reports a 'Leaked credentials' risk detection for a user account. The organization has a Conditional Access policy that requires MFA for medium and high user risk. The compromised user successfully authenticates with MFA and continues working. What additional remediation step should the security team take?
Select an answer to reveal the explanation.
Short Explanation
When Entra ID Protection confirms leaked credentials, you need to reset the password and revoke all refresh tokens. That evicts the attacker by invalidating existing sessions and tokens, and it dismisses the risk detection.
Full Explanation
The correct remediation is to reset the user's password in Microsoft Entra ID and revoke all refresh tokens. When leaked credentials are confirmed, the password is known to be compromised, even if the user successfully authenticates with MFA. Resetting the password addresses the compromised credential, and revoking all refresh tokens invalidates all existing sessions and tokens, evicting the attacker and allowing the risk detection to be dismissed. Blocking the user in Microsoft Entra ID and waiting 30 days before reactivating is incorrect because it is overly disruptive and indefinite; credential remediation is the correct approach, not permanent blocking. Requiring the user to re-register their MFA methods from a trusted device is incorrect because it does not address the leaked password, which is the compromised credential. Applying a Microsoft Purview Insider Risk Management policy to monitor the user's future activity is incorrect because Insider Risk Management is for behavior monitoring, not immediate incident remediation of a credential compromise.