A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via an API. Which Microsoft Entra ID feature should they configure?

Privileged Identity Management (PIM)

PIM focuses on just-in-time and time-bound access to privileged roles. It does not detect risks like leaked credentials or impossible travel, and is not designed for threat reporting.

Microsoft Entra ID Connect Health

Microsoft Entra ID Connect Health monitors the health of on-premises identity infrastructure (AD FS, AD DS, etc.). It does not detect cloud-based sign-in risks or generate risk reports.

Microsoft Entra ID Audit Logs

Audit logs record user and admin activities but do not automatically analyze or detect risks. They can be exported but lack built-in risk detection and reporting features.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Identity Protection — Microsoft Entra ID Identity Protection provides risk detection for various identity-based threats, including leaked credentials, impossible travel, and anonymous IP address sign-ins. It offers a risk report and integrates with SIEM systems via the Microsoft Graph API or Azure Monitor. Privileged Identity Management manages privileged access, not risk detection. Microsoft Entra ID Connect Health monitors hybrid identity infrastructure. Microsoft Entra ID Audit Logs record activities but do not automatically detect and report on identity risks.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.