easyMultiple ChoiceObjective-mapped
MS-102 Practice Question: Use Azure AD Identity Protection features such as…
A company wants to use Azure AD Identity Protection features such as user risk policies and sign-in risk policies to automatically respond to risky behavior. Which Azure AD license is required to enable these capabilities?
⚠ Common exam trap
Candidates often confuse Azure AD Premium P1 with P2, assuming Conditional Access alone enables risk policies, but P1 lacks the risk detection engine (Identity Protection) required for automated risk-based responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure AD Premium P2
Azure AD Identity Protection features like user risk policies and sign-in risk policies require Azure AD Premium P2. This is because P2 includes Identity Protection, which provides risk-based conditional access policies that automatically respond to detected risks. Azure AD Premium P1 supports Conditional Access but lacks the risk detection and automated remediation capabilities of Identity Protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure AD Free
Why it's wrong here
Azure AD Free includes only basic directory synchronization and default security features such as Security Defaults, which enforce baseline MFA, but it does not expose Identity Protection, risk detections, or any risk-based Conditional Access policy. The risk engine that calculates user risk and sign-in risk is not present in the free tier, so neither administrators nor automated policies can view or act on compromised identities. Consequently, any scenario requiring user-risk remediation cannot be satisfied with the Free license.
- ✗
Azure AD Premium P1
Why it's wrong here
Azure AD Premium P1 grants a full Conditional Access engine, including conditions like device compliance and MFA trust, but the 'User risk' and 'Sign-in risk' conditions are explicitly locked to Premium P2 and are surfaced through Identity Protection. In P1, you can create access policies, but no risk signal is available to feed them; risk detections require the P2 Identity Protection service to calculate and publish those signals. Therefore, while P1 is a prerequisite for many advanced controls, it cannot enforce a policy that automatically reacts to user-risk detection.
- ✓
Azure AD Premium P2
Why this is correct
Azure AD Premium P2 is the correct license because it includes Identity Protection, which continuously analyzes user and sign-in risk, and adds risk conditions to Conditional Access so you can enforce policies such as requiring a password change when user risk is high. Along with Privileged Identity Management and entitlement management, P2 gives you both the detection and the automated remediation capabilities. This is the only Azure AD edition listed that supports user-risk-based policies natively.
- ✗
Microsoft 365 E3
Why it's wrong here
Microsoft 365 E3 licensing includes Azure Active Directory Plan 1, which is functionally equivalent to Azure AD Premium P1, so it provides Conditional Access but omits the P2-only Identity Protection features like user risk and sign-in risk evaluations. Without an add-on such as Azure AD Premium P2 or an upgrade to Microsoft 365 E5, the tenant cannot apply risk-based policies or access the Identity Protection portal's risk reports. Thus, selecting E3 would not satisfy the requirement for user-risk functionality.
Go deeper
Related to this question
Learn chapter
Hybrid Identity with Entra Connect
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.