Microsoft Certified: Identity and Access Administrator AssociateImplement an authentication and access management solutionMedium
A security administrator is reviewing sign-in logs in Azure AD and notices a significant number of failed sign-in attempts from unusual locations for several user accounts. These accounts do not have any Conditional Access policies applied. The administrator wants to automatically detect and respond to these risky sign-in attempts by requiring MFA or blocking access when high risk is detected. Which Azure AD feature should the administrator configure?
- AAzure AD PIM role settings
- BConditional Access policies based on user groups
- CSecurity defaults
- DAzure AD Identity Protection risk policies
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD Identity Protection risk policies
Azure AD Identity Protection is specifically designed to detect and automatically respond to identity-based risks, such as unusual sign-in locations, by enforcing actions like requiring MFA or blocking access when a certain risk level is met. This directly addresses the administrator's goal.
Why the other options are wrong
- A. PIM role settings manage activation for privileged roles, not general sign-in risk detection for all users.
- B. While Conditional Access can use location, it's not primarily for *automatic risk detection and response* based on *behavioral* patterns like Identity Protection.
- C. Security defaults provide a baseline of security but are not as granular or behavior-driven as Identity Protection for detecting unusual sign-ins.
Azure AD Identity Protection
Azure AD Identity Protection is a security module that enables organizations to detect, investigate, and remediate identity-based risks. It identifies vulnerabilities, such as compromised credentials and risky sign-ins, and can automatically enforce policies like requiring MFA or blocking access.
- Detects user and sign-in risk.
- Offers automatic remediation policies (MFA, block access).
- Requires Azure AD Premium P2 license.
Memory trick: Identity Protection: Your personal risk bodyguard for sign-ins.