Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraHard
A security operations center (SOC) analyst observes a significant increase in sign-ins from unfamiliar locations and IP addresses, as well as attempts to access sensitive data from compromised credentials. The company wants a Microsoft Entra capability that can proactively detect these identity-based risks, investigate them, and automate remediation actions like blocking access or forcing password resets. Which Microsoft Entra capability provides this functionality?
- AMicrosoft Entra Privileged Identity Management (PIM)
- BMicrosoft Entra Conditional Access
- CMicrosoft Entra Identity Protection
- DMicrosoft Entra Access Reviews
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Identity Protection
Microsoft Entra Identity Protection is specifically designed to detect, investigate, and remediate identity-based risks. It uses machine learning to identify suspicious activities like unfamiliar sign-in locations or compromised credentials and can trigger automated remediation actions through Conditional Access policies.
Why the other options are wrong
- A. Microsoft Entra PIM manages just-in-time access for privileged roles, not general risk detection and remediation.
- B. Microsoft Entra Conditional Access enforces policies based on conditions but relies on Identity Protection for detecting many of the underlying risks.
- D. Microsoft Entra Access Reviews manage periodic review of access rights, not real-time risk detection and automated remediation.
Microsoft Entra Identity Protection
A security feature that helps organizations detect, investigate, and remediate identity-based risks in Microsoft Entra ID. It uses machine learning to identify suspicious activities.
- Detects identity-based risks (e.g., unfamiliar locations, compromised credentials)
- Investigates detected risks
- Automates remediation actions (e.g., block sign-in, force password reset)
Memory trick: Identity Protection: 'Detect, Investigate, Respond' to threats.