A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically detect users whose credentials have been leaked and require them to reset their password at their next sign-in. Additionally, they want to block sign-ins from anonymous IP addresses (e.g., Tor network). Which combination of Microsoft Entra ID features should they enable to meet both requirements?

Conditional Access with MFA policy and Identity Protection sign-in risk policy

Conditional Access can require MFA based on risk, but the requirement is to force a password reset, not just MFA. Identity Protection user risk policy is needed for that.

Privileged Identity Management and Conditional Access

Privileged Identity Management manages just-in-time privileged access and does not address leaked credentials or anonymous IP blocking for all users.

Microsoft Entra ID Connect Health and Identity Protection

Microsoft Entra ID Connect Health monitors the health of hybrid identity infrastructure and does not provide risk-based policies for password resets or blocking anonymous IPs.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Identity Protection user risk policy and sign-in risk policy — Identity Protection provides user risk policies (detect leaked credentials and require password change) and sign-in risk policies (block or allow MFA based on sign-in risk). Conditional Access can reference sign-in risk but does not directly trigger password resets. Privileged Identity Management is for privileged roles. Microsoft Entra ID Connect Health is for hybrid health monitoring.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.