A company uses Microsoft Entra ID (Microsoft Entra ID). They need to implement a solution that automatically detects identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via API. Which Microsoft Entra ID feature should they use?

Microsoft Entra ID Conditional Access

Conditional Access enforces policies based on risk level, but it does not generate risk detection reports or provide API access to risk data. It relies on Identity Protection for the risk detection.

Microsoft Entra ID Privileged Identity Management (PIM)

PIM manages just-in-time access for privileged roles and provides alerts for role activations, but it does not detect general identity risks like leaked credentials or impossible travel.

Microsoft Entra ID Entitlement Management

Entitlement management governs access to resources and manages access packages, but it does not provide risk detection or reports on sign-in risks.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Identity Protection — Microsoft Entra ID Identity Protection provides risk detection for users and sign-ins. It identifies various risk events (e.g., leaked credentials, impossible travel, anonymous IP) and provides dashboards and API access (via Microsoft Graph) for integration with SIEM systems. Conditional Access can enforce policies based on risk but does not provide the detection and reporting. PIM manages privileged roles. Entitlement management governs access. SIEM integration requires an API; Identity Protection exposes risk data through Microsoft Graph.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.