Entra ID Identity Protection: Detecting and Responding to Risky Sign-Ins
A company wants to monitor sign-in activity for their Microsoft Entra ID-integrated applications. They need to detect risky sign-ins, such as sign-ins from anonymous IP addresses or unfamiliar locations, and automatically block or require multi-factor authentication. They also need a dashboard showing risk events and the ability to investigate and remediate. Which Microsoft Entra ID feature should they use?
Quick Answer
The correct answer is Microsoft Entra ID Identity Protection. This feature is specifically designed to detect and respond to risky sign-ins by analyzing signals such as anonymous IP addresses, unfamiliar locations, and leaked credentials, then automatically blocking access or requiring multi-factor authentication through integration with Conditional Access policies. It also provides a centralized dashboard of risk events and supports investigation and remediation workflows, directly meeting the need to monitor sign-in activity for Entra ID-integrated applications. On the Microsoft Azure Solutions Architect Expert AZ-305 exam, this scenario tests your understanding of how Identity Protection operationalizes risk detection and response, often appearing as a distractor against standalone Conditional Access or Azure AD logs. A common trap is choosing Azure AD Premium P1 features alone, but remember that Identity Protection requires P2 for automated risk-based policies. Memory tip: think of Identity Protection as the “risk detective” that feeds signals into Conditional Access—without it, you can’t automate blocking or MFA based on sign-in risk.
⚠ Common exam trap
Many candidates confuse Privileged Identity Management (PIM) with Identity Protection because both involve 'risk' and 'security,' but PIM is solely for privileged role governance, not for detecting risky sign-ins from anonymous IPs or unfamiliar locations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Identity Protection
Microsoft Entra ID Identity Protection is the correct feature because it specifically detects and responds to risky sign-ins, such as those from anonymous IP addresses or unfamiliar locations, by automatically blocking access or requiring multi-factor authentication. It provides a dashboard of risk events (e.g., leaked credentials, impossible travel) and supports investigation and remediation workflows, directly matching the requirements for monitoring sign-in activity and enforcing conditional access policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Identity Protection
Why this is correct
Identity Protection detects risky sign-ins and user behavior, provides a risk dashboard, and integrates with Conditional Access to enforce policies like blocking or requiring MFA.
- ✗
Microsoft Entra ID Privileged Identity Management (PIM)
Why it's wrong here
PIM manages just-in-time access to privileged roles and provides monitoring of role activations, but it does not detect risky sign-ins for all users.
- ✗
Microsoft Entra ID Access Reviews
Why it's wrong here
Access Reviews allow administrators to periodically review group memberships and application access, but they do not detect risky sign-ins in real time.
- ✗
Microsoft Entra ID Self-Service Password Reset (SSPR)
Why it's wrong here
SSPR enables users to reset their own passwords, but it does not provide sign-in risk detection or automated remediation based on risk.
Go deeper
Related to this question
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-305
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to monitor the sign-in activities of users in Microsoft Entra ID and detect risky sign-ins, such as those from anonymous IP addresses. Which service should you use?
easy- ✓ A.Microsoft Entra Identity Protection
- B.Microsoft Defender XDR
- C.Azure Monitor
- D.Microsoft Sentinel
Why A: Microsoft Entra Identity Protection is the correct service because it is specifically designed to detect and respond to risky sign-in activities, including sign-ins from anonymous IP addresses, using machine learning-based risk detection policies. It integrates directly with Microsoft Entra ID to evaluate sign-in risk in real time and can automatically block or require multi-factor authentication based on configured risk thresholds.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.