Microsoft 365 Administrator MS-102 (MS-102) — Questions 226–300

The initial domain created when a Microsoft 365 tenant is provisioned always uses the <tenantname>.onmicrosoft.com namespace, and contoso.onmicrosoft.com is the default UPN and email domain for all new users. This domain is automatically reserved for your tenant and cannot be used by any other tenant, so assigning user@contoso.onmicrosoft.com is the only valid option listed without additional configuration.

Microsoft Entra B2B collaboration directly enables external sharing by letting you invite external partners into your tenant as guest users who authenticate with their own organizational or personal identity. It supports granular permissions, conditional access, and revocation without requiring you to manage those users' credentials. This is the core mechanism for giving outside collaborators secure access to your Entra ID-integrated applications.

Microsoft Entra ID P2 licensing is a hard prerequisite for implementing Identity Protection because risk detections, risk-based conditional access policies, and the Identity Protection report views are only included in the P2 tier. Attempting to configure these in a tenant with only P1 or free licensing will fail validation, as the underlying risk engine and policy controls are not provisioned.

Attack simulation training in Microsoft Defender for Office 365 is the dedicated capability for creating and launching realistic phishing simulations. It provides pre-built payload templates and enables you to target specific users or groups, then track who clicked, submitted credentials, or reported the simulated message. This is the only option that actively generates simulated threats rather than enforcing protection on live traffic.

Cloud Discovery is the feature in Microsoft Defender for Cloud Apps that ingests and analyzes traffic logs from network proxies and firewalls to identify all cloud apps in use, including unsanctioned shadow IT. It assigns risk scores to each discovered app and allows you to sanction or unsanction them based on organizational policy. This analysis is the foundational step for any subsequent control, such as Conditional Access App Control.

The application ID 00000003-0000-0000-c000-000000000000 is the fixed, well-known application ID for Microsoft Graph. This ID is present in every Microsoft Entra ID tenant as the Microsoft Graph service principal and is used by Azure CLI commands to inspect its roles, permission scopes, and other configuration. It is not tied to any single workload like Exchange or SharePoint; it represents the unified Microsoft Graph API across all Microsoft 365 services.

Microsoft 365 Defender portal (security.microsoft.com) is the single security operations console that aggregates alerts and incidents from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. Its unified incident queue correlates related alerts into a single incident, enabling triage, investigation, and response across all Microsoft 365 Defender workloads. This portal is the correct destination for viewing a unified incident queue.

A qualifying base Microsoft 365 license is a foundational prerequisite for Microsoft 365 Copilot because Copilot is an add-on that builds on existing Microsoft 365 services and data. Without a valid base license—such as E3, E5, or Business Standard—a user cannot receive Copilot features, as the add-on license is dependent on the underlying qualifying plan being present and active. Administrators must therefore verify each target user has an eligible base license before assigning the Copilot add-on license.

The 'Activity from risky IP address' template is a built-in anomaly detection policy in Microsoft Defender for Cloud Apps that leverages Microsoft threat intelligence to identify IP addresses associated with malicious activity, such as anonymous proxies, Tor exit nodes, or known botnets. When a user performs an activity from one of these IPs, the policy generates an alert, giving security teams immediate visibility into the potentially compromised session. This is exactly the alerting capability needed in this scenario.

The user risk policy responds to the aggregate probability that a user's identity has been compromised, based on multiple risk detections associated with that account. It can be configured to automatically block all access or trigger a secure password change with required MFA, based on the user risk level (low, medium, high). This is precisely the Microsoft Entra ID Protection mechanism designed for user risk levels, making it the correct answer.

Together, these tables provide a complete attack chain: IdentityLogonEvents records sign-in and logon attempts, revealing suspicious authentication patterns tied to a specific account; EmailEvents tracks email send/receive activity, enabling correlation of a phishing email or malicious attachment; and DeviceProcessEvents logs process creation, which exposes lateral movement when a compromised account launches a remote service, script, or executable. Joining these tables on user SID and device ID lets an investigator reconstruct the timeline from email receipt to identity compromise to endpoint execution.

Microsoft Entra B2B collaboration is the appropriate feature because it allows you to invite external partner users from another Azure AD/Microsoft Entra tenant to access your resources while they authenticate with their own home-tenant credentials. This approach eliminates the need for creating separate accounts, maintains the partner's own identity lifecycle, and integrates with conditional access policies and access reviews, making it ideal for multi-tenant collaboration.

This is the correct answer because Microsoft 365 licenses contain granular service plans, and each plan can be independently toggled on or off for a user while the license remains assigned. If the SharePoint Online (SHAREPOINT) service plan is disabled, the user loses access to SharePoint Online but continues to access other services like Exchange Online. This selectively prevents access only to SharePoint, matching the user's report.

Submissions in Microsoft Defender XDR lets administrators send user-reported or suspicious emails, including attachments, for automated investigation and rescanning. It satisfies the requirement because the message was delivered, so it must be submitted manually rather than relying on EOP blocking.

A Conditional Access policy with a Sign-in risk condition evaluates the risk score that Azure AD Identity Protection assigns to each authentication attempt in real time. Setting the condition to 'High' and the access control to 'Block access' prevents compromised credentials from being used before a session is established. Separately configuring alert notifications in Identity Protection ensures that administrators are immediately notified when such high-risk sign-ins are attempted, providing both remediation and visibility.

With federated authentication, Azure AD redirects authentication to ADFS, so Azure AD never performs or observes the actual password validation and cannot compute sign-in risk for that exchange. Switching to Pass-through Authentication (PTA) or Password Hash Sync (PHS) makes Azure AD the authentication authority: PTA validates against on-prem AD through an agent, while PHS validates against synced hashes. Because the token is issued by Azure AD after credential verification, Identity Protection can evaluate risk before the user receives access.

In a hybrid deployment, on-premises mailboxes are treated as 'Inside the organization' by Exchange Online. Therefore, a rule that applies to messages sent to 'Outside the organization' and has a condition that the sender is located 'Inside the organization' will correctly match messages sent from on-premises mailboxes to external recipients. The action to prepend a disclaimer will add the disclaimer to those messages. This configuration meets the requirement precisely and is the standard method for applying disclaimers to outbound mail from on-premises senders in a hybrid setup.

The Incident summary report is a built-in Defender XDR report that aggregates incident classifications, including true positive, false positive and benign counts, over a selectable period such as 30 days. It satisfies the no-custom-queries constraint directly, unlike advanced hunting or custom workbooks.

To enforce MFA everywhere except the corporate office, you create a Conditional Access policy assigned to the target users and cloud apps, add your trusted corporate IP ranges as a Named Location, and set that location in the Exclude condition. Then, in Grant, you select 'Require multifactor authentication.' For sign-ins from any IP address that does not match the excluded Named Location, the grant control is applied and MFA is required; for sign-ins from the corporate location, the exclusion prevents MFA from being required. This is the actual policy object that implements the stated requirement.

Conditional Access policies in Microsoft Entra ID can enforce that devices must be marked as compliant by Intune or another MDM solution before granting access to Microsoft 365 services. This directly meets the requirement by evaluating device compliance at sign-in and blocking non-compliant devices.

Threat Explorer provides message trace, detection technology and delivery location per email, letting you determine which anti-phishing control failed and why. It is the Microsoft Defender for Office 365 tool built for investigating individual messages.

Authentication strengths enforce phishing-resistant MFA, while Conditional Access applies compliant-device and location blocks. Identity Protection supplies real-time risk detection with automated remediation, and entitlement management with connected organisations plus sponsor-approved access reviews governs external collaboration, meeting all five stated requirements.

In Microsoft Entra ID, under Device settings, the 'Enable automatic enrollment for MDM' option (also known as MDM user scope) directs the identity provider to register and enroll devices into the configured MDM authority, Intune, as part of the user sign-in flow. Because every user in the organization holds a Microsoft 365 Business Premium license that includes Intune, toggling this setting causes their devices to automatically enroll upon authentication and license assignment. This is the only option that actively triggers enrollment; the other options are post-enrollment or pre-enrollment controls that do not initiate the enrollment process.

During initial tenant provisioning, the Microsoft 365 admin center's data location setting lets you choose the main geographic region (for example, Europe, Asia Pacific) where core Microsoft 365 data for the tenant will be stored at rest. This selection determines the primary residency for Exchange Online mailboxes, SharePoint/OneDrive content, and Teams data. Because the choice is made at tenant creation and is largely immutable for existing tenants, it must be aligned with the multinational's data-residency requirements before provisioning begins.

Exchange Online licenses are assigned per user through the Microsoft 365 admin center or Azure AD, and each user needs an active license with the Exchange Online service plan before a mailbox is provisioned. Without that license, the user remains able to authenticate to Microsoft 365 and use other services, but Outlook on the web will fail with a 'no mailbox' or 'license' error because Exchange does not find a recipient object. This exactly matches the reported scenario: one user cannot access their Exchange Online mailbox while other functionality may still work.

Automated Investigation and Response (AIR) is a premium Plan 2 capability that uses orchestration and automation to investigate alerts, analyze threat signals, and take recommended or automated remediation actions. It goes beyond passive detection by proactively resolving incidents without requiring continuous manual oversight, making it a key differentiator for Plan 2 licensing.

This policy correctly scopes the requirement: every user is in scope, and the location condition is evaluated during sign-in. When a user's IP address is not within a trusted location (i.e., an IP range you have designated as trusted), the grant control 'Require MFA' is enforced, prompting for multifactor authentication. When the user is in a trusted location, the condition is not satisfied and the policy does not apply, so MFA is not required—matching the business requirement exactly. The location condition acts as a filter, not an assignment, which is the intended design.

A conditional access policy requiring compliant devices blocks unmanaged devices while permitting Intune-managed ones, since compliance state is evaluated per device. Applying it to all cloud apps enforces this across Microsoft 365 workloads, satisfying the strict compliance requirement.

Password writeback in Azure AD Connect is the component that synchronizes password changes from Azure AD back to on-premises Active Directory. With password hash sync, the cloud authentication works, but a cloud-initiated reset only updates the Azure AD password unless writeback is enabled. This feature requires Azure AD Premium and an on-premises service account with rights to update user passwords, ensuring the next sign-in with on-premises credentials uses the new password.

The query returned zero rows because no antivirus detection events with a filename containing the exact term 'ransomware' or 'encrypt' were logged in the last 7 days. This is a valid, actionable result; it does not mean the query is flawed. To uncover broader suspicious activity, reduce reliance on the filename term match or use contains for substring matching, and consider expanding the time range or adding related tables like DeviceFileEvents.

Content inspection, such as DLP, examines the file payload to confirm it actually contains sensitive data, satisfying the stem's sensitive-data condition. Sharing filters alone cannot determine content; inspection is what distinguishes a genuine sensitive-data exposure from an ordinary external share.

This Attack Surface Reduction (ASR) rule, identified by rule GUID 26190899-1602-49e8-8b27-eb1d0a1ce869, specifically targets the parent-child relationship where winword.exe, excel.exe, or powerpnt.exe attempts to launch any secondary executable. By blocking the creation of child processes such as cmd.exe, powershell.exe, or wscript.exe, it directly neutralizes the described macro-based attack chain before the payload can execute. This is the only option among these that was designed to stop exactly this process-spawn behavior.

DeviceNetworkEvents contains network connection events from devices, including remote IP addresses and ports. Querying this table allows you to filter by RemoteIP and time range to find devices that communicated with the malicious IP. This is the correct table for network communication history in Microsoft Defender XDR advanced hunting.

This policy applies the 'Grant' control 'Require MFA' only when the 'Sign-in risk' condition is evaluated as medium or higher, and it explicitly excludes users who sign in from a named location marked as trusted. When a sign-in originates from an excluded trusted location, the policy is not evaluated, allowing seamless access without MFA. For risky sign-ins coming from any other IP, the policy triggers MFA, thereby satisfying the requirement to require MFA for medium+ risk while exempting trusted locations.

Settings > Domains is the correct location in the Microsoft 365 admin center for adding, verifying, and managing custom domains. From this blade, you can initiate domain verification via a DNS TXT record or MX record, designate a primary domain, set the domain for services like Exchange Online, and monitor domain health. This is the unified domain management interface that most administrators use for day-to-day domain lifecycle tasks.

The 'Client apps' condition in Entra ID Conditional Access directly matches the authentication protocol used by the client. By selecting 'Exchange ActiveSync clients' and 'Other clients' (which cover POP3, IMAP, SMTP, and other non-modern authentication), you can explicitly block those legacy protocols while allowing modern, MFA-capable clients to continue. This is the precise and least disruptive way to enforce the security requirement.

EmailEvents tracks email delivery metadata only, such as sender, recipient, subject, delivery action, and message ID, but it does not enumerate the URLs contained in the message body. UrlClickEvents references the clicked URL but does not include the email's NetworkMessageId unless the URL was part of a Safe Links click from an email, and even then you need URL information to correlate. Without the URL-to-email mapping that EmailUrlInfo provides, joining EmailEvents to UrlClickEvents is not straightforward and would require a separate enrichment step, so this pairing is incorrect for URL-click detection.

Creating a custom role that omits the 'microsoft.directory/applications/credentials/update' permission ensures the user cannot change application secrets, certificates, or passwords, while still allowing other application management actions. Custom roles in Microsoft Entra ID allow you to compose a permission set from the available permissions, enabling you to exclude sensitive operations. Assigning this custom role to the user satisfies the requirement to prevent credential updates without over-restricting other updates.

The automation level setting in Microsoft Defender for Endpoint determines how automated investigations and response actions are taken. Setting it to 'Full - remediate threats automatically' allows the system to automatically isolate devices and quarantine files upon high-severity alerts, achieving the required no-manual-intervention remediation.

Microsoft 365 permits two common verification methods: a TXT record containing 'MS=msXXXXXX' or an MX record pointing to 'msXXXXXX.adatum.com'. The MX verification record is a valid alternative that works by having you create a mail exchanger record with the exact verification token as the mail host. This record is non-authoritative and does not affect mail routing because it points to a Microsoft verification endpoint that only checks for the token. Once the token is confirmed, the MX record can be safely removed.

In this solution, Azure AD group-based licensing is combined with a dynamic group whose membership rule filters users where user.department equals 'Finance'. As new Finance employees are created, they automatically become group members based on their department attribute, and Azure AD evaluates membership to provision the Microsoft 365 E3 license within minutes. If a user's department changes, membership is recalculated and the license is automatically removed, providing fully automatic, attribute-driven lifecycle management.

Enabling the override with justification in the policy tip satisfies the requirement to permit legitimate sharing while capturing a reason. The policy tip appears in Teams, letting users proceed after entering a business justification, and audit logging records each override for later review and compliance reporting.

Indicators of compromise (IoC) in Microsoft 365 Defender for Endpoint let administrators explicitly define block actions for known malicious artifacts, including file SHA-256 hashes, IP addresses, URLs, and domains. After the analyst obtains the malware sample's exact hash, they can create a file indicator (with action 'Block and remediate') so that Defender blocks execution across managed endpoints. This is the only option here that directly provides granular, hash-based allow/block control rather than relying on behavioral heuristics or post-detection response.

Modifying the Conditional Access policy to exclude the Microsoft 365 admin center from the device compliance requirement, while keeping MFA, is a least-privilege approach. This allows administrators to sign in to the admin center from any device using MFA as a compensating control, but still enforces device compliance for all other cloud apps. This balances security and usability by scoping the exception only to the app that is causing the issue.

Conditional Access is the correct answer because it evaluates signals like device compliance before granting access. In Intune, compliance policies assess device health, and Conditional Access policies can require those devices to be marked compliant, blocking or allowing access based on that state. This direct integration makes it the tool that checks device compliance from Intune for MDM-managed devices.

PIM allows you to assign users as eligible for privileged roles. When they need the role, they must activate it, optionally providing justification and passing MFA. This minimizes standing access and meets the requirement. It is the correct solution for just-in-time privileged access.

Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time (JIT) activation of Azure AD roles, allowing eligible members to request elevated access with a defined start time, duration, and justification. Administrators can configure PIM to require approval from designated approvers before the role becomes active, ensuring every privileged activation is audited and time-boxed. This directly fulfills the scenario’s requirement for managed, approval-based, and time-limited privileged role activation. No other Entra ID feature combines role assignment, approval workflow, and expiration in this way.

Security defaults in the Microsoft Entra admin center enforces MFA for every user, blocks legacy authentication, and requires users to complete MFA registration on first sign-in — all with a single toggle and no conditional access policy creation. For a small business without granular exclusion requirements, this is the fastest and most minimal-configuration path to satisfy the scenario. Microsoft recommends security defaults for tenants that do not have Microsoft Entra ID P1/P2 licenses, and even with Business Premium it provides immediate baseline protection without policy dependencies.

Selecting Mobile app notification satisfies the mobile app authentication method category, while Office phone is classified under the phone call category. This combination fulfills the SSPR policy requirement of having two methods from different categories, ensuring users can verify identity via either the Microsoft Authenticator push notification or a call to their office landline. It also aligns with best practices for SSPR availability by providing diverse verification options.

Audit retention policies in Microsoft Purview allow you to retain specific audit records for a custom duration, up to 10 years, independent of the default tenant retention. Applying the policy to admin activities ensures those events are kept for seven years, meeting the security team's requirement without affecting other workloads.

This ASR rule is specifically designed to block Office applications from spawning child processes, such as when Word launches PowerShell via a malicious macro. In this attack chain, the macro directly invokes PowerShell as a new process, so blocking child process creation breaks the execution chain at the critical point. Other ASR rules target different stages like API calls or code injection, but the core action here is the creation of the child process.

Helpdesk Administrator is the correct choice because Microsoft Entra ID grants this role the combined abilities to reset passwords for non-administrator users and to manage license assignments by including the License Administrator permission as part of its delegated scope. Critically, it explicitly excludes the more privileged User Administrator capabilities such as deleting users or modifying user principal names (UPNs), which aligns exactly with the stated restrictions. This makes Helpdesk Administrator the least-privileged built-in role that satisfies both required tasks without permitting the prohibited actions.

DLP policies in Exchange Online are the correct mechanism because they inspect email content in transit against sensitive information types (e.g., credit card numbers, social security numbers) and can trigger a real-time block action, such as rejecting or quarantining the message before it reaches the recipient. DLP also surfaces policy tips in Outlook to notify users that their message violates a policy, giving them a chance to modify or resend it. This proactive, content-aware enforcement is exactly what the compliance officer needs.

Microsoft 365 license assignments include per-service-plan toggles, and when the Teams service plan is disabled for a user, Teams will not launch even though the user still appears as licensed. The user can have a fully valid E3 license with Exchange Online, SharePoint Online, and other plans active, but if the Teams plan is unchecked, the Teams client cannot authenticate or access the service. Enabling the Teams service plan on the user's license assignment is the required corrective action.

The correct approach is to add the legitimate sender domains to the allowed senders list within the anti-phishing policy in Microsoft Defender for Office 365. Doing so instructs the impersonation detection engine to trust those specific domains, thereby preventing legitimate messages from being flagged as impersonation attempts while still applying malware scanning, spam filtering, and spoof intelligence to those messages. This is a targeted exception that does not weaken global security, making it the recommended and effective way to reduce phishing false positives for trusted domains.

Information barriers use segments to group users and policies to define allowed or blocked communication between segments. You must first create segments for Sales, Research, and Legal, then define policies that block Sales-Research and allow Sales-Legal and Research-Legal. This is the foundational step to enforce the restriction.

Microsoft Defender for Cloud Apps Conditional Access App Control (ACAC) is correct because it functions as a session-level reverse proxy that intercepts the user's session after authentication, enabling real-time controls like blocking downloads, preventing paste, and redacting sensitive data. By routing the application through Defender for Cloud Apps, you can target it with a Conditional Access policy using the 'Use Conditional Access App Control' session control, which works even for third-party SaaS apps that lack native Conditional Access support. This provides the exact session-level enforcement and visibility needed.

Content search in Microsoft Purview is the correct tool because it performs a full-text query across all Exchange Online mailboxes using a KQL query. You can combine keywords such as "confidential" with date filters like "sent >= 01/01/2024" to find messages containing the specified text, and you can include inactive mailboxes and public folders. It directly meets the requirement to search for specific keywords inside emails, not merely metadata about them.

The Microsoft Defender for Endpoint connector is a built-in Sentinel data source that directly ingests endpoint detection and response telemetry, including tables such as DeviceLogonEvents, DeviceProcessEvents, and DeviceNetworkEvents. These raw Advanced Hunting events enable detections for malware, lateral movement, and other endpoint attacks. Without this connector, endpoint visibility would rely on manual log forwarding or third-party agents.

Correct: Cloud Apps can suspend user and trigger password reset via integration with Entra ID.

The DeviceNetworkEvents table in advanced hunting contains information about network connections initiated by or involving devices, including remote IP addresses. Querying this table allows you to filter for the specific IP address and the time range, returning the devices that communicated with it. This directly answers the requirement.

The device is non-compliant because Microsoft Intune compliance policies evaluate security update installation as a required health condition. Missing security updates cause the compliance state to become 'non-compliant', which triggers the Conditional Access policy's 'Require device to be marked as compliant' grant control and blocks access to SharePoint Online. The user's license and the policy's application scope are irrelevant because the failure is specifically the device's compliance state.

Information Protection's trainable classifiers are machine learning models that learn to recognize specific content patterns from seed documents and then automatically classify SharePoint documents. Once trained, these classifiers can drive sensitivity labels, retention labels, or communication compliance policies, enabling automatic identification without manual scanning. This is the correct approach because the compliance officer needs to identify documents based on content, and trainable classifiers are purpose-built for that.

Microsoft Entra B2B collaboration is the intended mechanism for inviting external vendors, because it creates a guest user identity that can be scoped to specific resources such as a SharePoint site. Combined with the guest user expiration policy in Entra ID, you can specify a fixed number of days before the account becomes inactive, enforcing time-bound access without any manual offboarding. This approach aligns with zero-trust principles and ensures the vendor's access automatically expires after the engagement.

Creating a new Azure AD security group and assigning the license to that group is the definitive group-based licensing model. Once the license is assigned to the group, all current members immediately receive it, and any users added later are automatically provisioned without an admin step. Because group membership controls the license assignment, this method scales efficiently and provides a clean audit trail, which is exactly why Microsoft recommends it for bulk user licensing.

Sensitivity labels with auto-labeling can apply the label automatically based on sensitive info types. However, to prevent users from removing the label, you must configure advanced protection settings (e.g., require justification to remove the label) rather than just 'Mark content as mandatory', which only requires a label to be present. Despite the inaccurate setting name, the correct concept is using sensitivity labels with appropriate protection settings.

The Microsoft 365 admin center is the designated operational hub for managing Microsoft 365 user accounts, including creating new users, resetting passwords, adding users from a CSV, and assigning or revoking Microsoft 365 subscription licenses. It provides a service-aware view of all M365 workloads and is the primary portal for common administrative tasks like user lifecycle management and billing. While identity data resides in Microsoft Entra ID, the M365 admin center is the intended interface for day-to-day account administration.

Using the Microsoft Entra ID Protection reports to confirm the user as safe is the correct manual remediation action when investigation shows the risk detection is a false positive or the account is validated as legitimate. Selecting 'Confirm user safe' on the Risky users report dismisses the risk, resets the user's risk level, and removes the user from the risky users list, allowing sign-ins to proceed normally without requiring a password reset. This action should be performed only after verifying the user's identity and activity, as it is a permanent dismissal that prevents risk-based conditional access policies from challenging the user in the future.

Sensitivity labels in Microsoft Purview can be configured with encryption or permissions settings that explicitly exclude the Copilot service principal, preventing Copilot from retrieving labeled content. For example, applying a label with 'Do Not Forward' or custom conditional access grants ensures Copilot only returns data when the user has the corresponding decryption rights. This provides granular control at the file level, allowing specific documents or emails to be hidden from Copilot-generated responses while other content remains accessible.

This correct ASR rule (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) evaluates every executable launched against Microsoft's cloud reputation service, checking prevalence, age, and any tenant-configured trusted list. Files that are unknown, new, or untrusted are blocked at the point of execution, which directly addresses the requirement to block users from running portable executables like .exe and .scr downloads. Because it operates on the executable itself, it is the only option that matches the stated intent.

Global Administrator holds the highest-level role in Microsoft 365 and inherits every permission, including the ability to view the Service Health dashboard and configure email notifications for service health incidents. Under 'Service Health' in the Microsoft 365 admin center, a Global Administrator can select 'Edit preferences' to subscribe to incident email alerts for all services. No other role has the necessary write permission to change those notification preferences, so only this role fully satisfies the requirement.

Identity Protection detects leaked credentials and anomalous sign-in behaviour via its risk detections, then applies risk-based Conditional Access policies. A policy requiring password change for high-risk users automates remediation, satisfying the P2-licensed requirement to identify and respond to risky users.

The policy is disabled, so it should not be causing automatic deletion. This is the correct identification of the issue as stated.