The answer is Microsoft Entra ID Identity Protection. This feature is correct because it continuously analyzes user sign-in behavior to detect risks such as anonymous IP addresses and unfamiliar locations, then enforces real-time automated responses like blocking the sign-in or requiring multi-factor authentication (MFA), while also providing a centralized risk dashboard for investigation. On the AZ-305 exam, this scenario tests your understanding of how Identity Protection integrates risk-based conditional access policies, often appearing as a design choice for securing hybrid identities. A common trap is confusing it with Entra ID Conditional Access alone—remember that Conditional Access enforces policies, but Identity Protection provides the risk detection and reporting engine. Memory tip: think of Identity Protection as the “risk radar” that feeds signals to Conditional Access for action.
AZ-305 Practice Question: Design identity, governance, and monitoring solutions
This AZ-305 practice question tests your understanding of design identity, governance, and monitoring solutions. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: detects identity-based risks like anonymous IP sign-ins and unfamiliar locations.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect sign-in attempts from anonymous IP addresses and sign-ins from unfamiliar locations. When such a risk is detected, they want to block the sign-in or require multi-factor authentication (MFA) in real time. Additionally, they need a dashboard that provides a summary of risk events and allows investigation. Which Microsoft Entra ID feature should they use?
Identity Protection detects risky sign-ins and provides a dashboard with risk events for investigation. It can feed risk data into Conditional Access for enforcement.
B
Microsoft Entra ID Conditional Access
Why wrong: Conditional Access enforces policies based on conditions, including detected risk, but it does not detect risks or provide a risk dashboard itself.
C
Microsoft Entra ID Privileged Identity Management (PIM)
Why wrong: PIM manages privileged roles with just-in-time access and approvals, not risk detection for sign-ins.
D
Microsoft Entra ID Access Reviews
Why wrong: Access reviews periodically audit group memberships and application access, but they do not detect real-time risk events.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Identity Protection
Microsoft Entra ID Identity Protection is the correct feature because it automatically detects sign-in risks such as anonymous IP addresses and unfamiliar locations, and can trigger real-time remediation actions like blocking the sign-in or requiring MFA. It also provides a risk dashboard and investigation capabilities, directly matching the requirements for risk detection, automated response, and reporting.
Key principle: Detects identity-based risks like anonymous IP sign-ins and unfamiliar locations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Microsoft Entra ID Identity Protection
Why this is correct
Identity Protection detects risky sign-ins and provides a dashboard with risk events for investigation. It can feed risk data into Conditional Access for enforcement.
Related concept
Detects identity-based risks like anonymous IP sign-ins and unfamiliar locations.
✗
Microsoft Entra ID Conditional Access
Why it's wrong here
Conditional Access enforces policies based on conditions, including detected risk, but it does not detect risks or provide a risk dashboard itself.
✗
Microsoft Entra ID Privileged Identity Management (PIM)
Why it's wrong here
PIM manages privileged roles with just-in-time access and approvals, not risk detection for sign-ins.
✗
Microsoft Entra ID Access Reviews
Why it's wrong here
Access reviews periodically audit group memberships and application access, but they do not detect real-time risk events.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Conditional Access as the detection mechanism, but Conditional Access is only the enforcement layer; Identity Protection is the actual detection engine that generates the risk signals used by Conditional Access.
Detailed technical explanation
How to think about this question
Identity Protection uses machine learning models and heuristics to evaluate sign-in events in real time, assigning a risk level (low, medium, high) based on signals like anonymous IP addresses (from known proxy/VPN lists) and unfamiliar location properties (geolocation anomalies). When a risk is detected, it can trigger Conditional Access policies via the 'Require MFA' or 'Block access' grant controls, and all risk events are logged in the Identity Protection dashboard for investigation, including detailed risk reasons and user risk history.
KKey Concepts to Remember
Detects identity-based risks like anonymous IP sign-ins and unfamiliar locations.
Provides a dashboard for investigating risk events and users.
Calculates a real-time risk score for users and sign-ins.
Feeds risk data into Conditional Access policies for automated enforcement.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Detects identity-based risks like anonymous IP sign-ins and unfamiliar locations.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-305 question in full detail.
Review detects identity-based risks like anonymous IP sign-ins and unfamiliar locations., then practise related AZ-305 questions on the same topic to reinforce the concept.
Design identity, governance, and monitoring solutions — This question tests Design identity, governance, and monitoring solutions — Detects identity-based risks like anonymous IP sign-ins and unfamiliar locations..
What is the correct answer to this question?
The correct answer is: Microsoft Entra ID Identity Protection — Microsoft Entra ID Identity Protection is the correct feature because it automatically detects sign-in risks such as anonymous IP addresses and unfamiliar locations, and can trigger real-time remediation actions like blocking the sign-in or requiring MFA. It also provides a risk dashboard and investigation capabilities, directly matching the requirements for risk detection, automated response, and reporting.
What should I do if I get this AZ-305 question wrong?
Review detects identity-based risks like anonymous IP sign-ins and unfamiliar locations., then practise related AZ-305 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Detects identity-based risks like anonymous IP sign-ins and unfamiliar locations.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect identity risks, such as users with leaked credentials or sign-ins from anonymous IP addresses, and generate alerts. They also want to automatically trigger a password reset for high-risk users. Which Microsoft Entra ID feature should they configure?
easy
✓ A.Microsoft Entra ID Identity Protection
B.Microsoft Entra ID Privileged Identity Management
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Access Reviews
Why A: Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect identity risks such as leaked credentials and sign-ins from anonymous IP addresses. It generates alerts based on risk detections and can be configured to automatically trigger remediation actions like forcing a password reset for high-risk users through risk-based policies.
Variation 2. A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect identity-related risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. They want to generate reports summarizing risk events and integrate the risk data with their existing Security Information and Event Management (SIEM) system via an API. Which Microsoft Entra ID feature should they configure?
easy
✓ A.Microsoft Entra ID Identity Protection
B.Privileged Identity Management (PIM)
C.Microsoft Entra ID Connect Health
D.Microsoft Entra ID Audit Logs
Why A: Microsoft Entra ID Identity Protection is the correct feature because it provides automated detection of identity-based risks such as leaked credentials, impossible travel, and sign-ins from anonymous IP addresses. It generates risk event reports and exposes risk data through the Microsoft Graph API, enabling integration with SIEM systems for centralized monitoring and response.
Variation 3. A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically detect and respond to high-risk sign-in events, such as sign-ins from malware-linked IP addresses or leaked credentials. When such risks are detected, they want to require multi-factor authentication (MFA) or block the sign-in. They also need a dashboard to review risk events and generate reports. Which Microsoft Entra ID feature should they configure?
easy
A.Microsoft Entra ID Privileged Identity Management (PIM)
✓ B.Microsoft Entra ID Identity Protection
C.Microsoft Entra ID Conditional Access
D.Microsoft Entra ID Identity Governance
Why B: Microsoft Entra ID Identity Protection is the correct feature because it is specifically designed to automatically detect and respond to high-risk sign-in events, such as sign-ins from malware-linked IP addresses or leaked credentials. It provides risk-based conditional access policies that can require MFA or block sign-ins, and it includes a dashboard for reviewing risk events and generating reports. This aligns directly with the scenario's requirements for detection, automated response, and reporting.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.