AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Many exam-takers confuse Conditional Access (which enforces policies) with Identity Protection (which detects risks), but Conditional Access relies on Identity Protection's risk signals and cannot generate risk events on its own.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Identity Protection
Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It provides risk event reports and integrates with SIEM systems via the Microsoft Graph API, enabling automated risk data export for centralized monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Conditional Access
Why it's wrong here
Microsoft Entra ID Conditional Access is a policy engine that consumes risk signals to enforce access controls (e.g., requiring MFA when sign-in risk is medium). However, it does not perform risk detection itself, generate risk detection reports, or expose raw risk events via API. Its role is to evaluate conditions and apply policies, not to be the source of identity risk data, which is why it cannot satisfy the requirement for API-driven risk report retrieval.
- ✓
Microsoft Entra ID Identity Protection
Why this is correct
Microsoft Entra ID Identity Protection is the correct service because it continuously detects a broad range of identity risks—including leaked credentials, impossible travel, unfamiliar sign-in properties, and anomalous user activity—and stores each detection as a rich risk event. It provides detailed risk reports in the portal and, importantly, exposes these risk events through Microsoft Graph API endpoints (e.g., riskDetection and riskyUser), enabling direct integration with a SIEM. This combination of detection, reporting, and API access makes it the only option that meets the stated requirement.
- ✗
Microsoft Entra ID Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) is focused exclusively on governing privileged roles through just-in-time activation, approval workflows, and time-bound assignments. While PIM produces activation logs and alerts for suspicious role activations, it does not detect general identity risks such as leaked credentials, token anomalies, or impossible travel, nor does it provide risk detection reports or risk-specific Graph API endpoints. Its scope is access elevation, not identity risk detection.
- ✗
Microsoft Entra ID Entitlement Management
Why it's wrong here
Microsoft Entra ID Entitlement Management manages access lifecycle by creating access packages, defining policies for requesting/approving access, and performing periodic access reviews. It is purely an access governance tool and does not evaluate risk signals, detect leaked credentials, or generate risk reports. Unlike Identity Protection, it has no Graph API risk event endpoints and cannot serve as a source for SIEM risk data, making it unrelated to the requirement for identity risk detection.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.