A company uses Microsoft Entra ID (Microsoft Entra ID) Premium P2. They need to automatically block sign-ins from anonymous IP addresses (e.g., Tor) and force users from risky sign-ins to reset their password. They want to minimize administrative effort and use built-in features. Which Microsoft Entra ID feature should they enable?

Conditional Access policies with locations and grant controls.

Conditional Access can block specific IP ranges but cannot automatically detect anonymous proxies like Tor as a built-in risk. It would require custom IP lists and does not trigger password reset based on user risk. Identity Protection is needed for risk detection.

Microsoft Entra ID Privileged Identity Management (PIM).

PIM is used for managing, controlling, and monitoring access to privileged roles. It does not detect sign-in risks or block anonymous IP addresses.

Microsoft Entra ID Access Reviews.

Access Reviews are for periodic verification of group memberships and application access. They do not provide real-time risk detection or automatic remediation.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Identity Protection risk policies (sign-in risk and user risk). — Microsoft Entra ID Identity Protection provides pre-configured risk policies: a sign-in risk policy can block sign-ins from anonymous IP addresses, and a user risk policy can force a password reset when a user's credentials are compromised. Conditional Access alone lacks the automated risk detection; it can be used in combination but Identity Protection is the core service. Privileged Identity Management (PIM) is for privileged role management, and Access Reviews are for periodic attestation.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.