A company uses Microsoft Entra ID. They want to automatically detect sign-ins from anonymous IP addresses, sign-ins from unfamiliar locations, and other risky activities. When such a risk is detected, they want to block the sign-in or require multi-factor authentication. They also need a dashboard to review risk events. Which Microsoft Entra ID feature should they use?

Microsoft Entra ID Conditional Access

Conditional Access enforces policies based on conditions but does not detect risks itself; it relies on Identity Protection risk data.

Microsoft Entra ID Privileged Identity Management (PIM)

PIM is for managing, controlling, and monitoring privileged role access, not for general identity risk detection.

Microsoft Entra ID Access Reviews

Access Reviews are for periodic recertification of user access, not for real-time risk detection and response.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Identity Protection — Microsoft Entra ID Identity Protection provides risk detection for sign-ins and users, and allows configuring policies to automatically respond to risks (e.g., block access, require MFA). It offers a risk dashboard for investigation. Conditional Access is the engine to enforce policies, but Identity Protection is the service that detects and provides risk signals for Conditional Access policies. Privileged Identity Management (PIM) is for privileged role access. Access Reviews are for periodic access certification.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.