A company uses Microsoft Entra ID. They need to automatically block sign-ins from users whose accounts have been identified as high-risk for compromise. They also want users to be prompted to reset their password when the risk is detected. Which Microsoft Entra ID feature should they use?

Microsoft Entra ID MFA

MFA adds a second factor but does not automatically block or force password change based on risk.

Microsoft Entra ID Privileged Identity Management

PIM manages just-in-time access for privileged roles, not user risk.

Conditional Access with location policy

Location policy blocks based on geography, not user risk level.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Identity Protection with user risk policy — Microsoft Entra ID Identity Protection provides user risk policies that can automatically block sign-ins or require password change when risk is high. Conditional Access policies can also be based on risk but are typically applied to sign-in risk rather than user risk. MFA is a method, not a risk-based policy. PIM manages privileged access, not risk.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.