Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 826–900

Microsoft Entra entitlement management is the correct solution as it allows organizations to manage identity and access lifecycle for both internal and external users at scale. It enables the creation of 'access packages' that bundle resources and define policies, including explicit expiration dates for assignments. When access is granted via an access package, it is automatically revoked upon the specified expiration, ensuring time-limited access.

This statement is correct. The network access configuration includes an "ipRules" entry specifically allowing traffic from the "10.0.0.0/24" subnet. Since the "defaultAction" is set to "Deny," any network traffic originating from outside this explicitly permitted IP range will be blocked. This creates a precise security boundary, restricting access exclusively to the specified subnet.

Microsoft Purview Information Protection (MPIP) enables organizations to discover, classify, and protect sensitive data wherever it lives or travels. By applying sensitivity labels to documents, emails, and Teams messages, MPIP can automatically or manually identify sensitive content and enforce protection actions like encryption, visual markings, and access restrictions. This directly helps identify and safeguard sensitive information across the digital estate.

Microsoft Entra Conditional Access is the policy engine that evaluates various signals in real-time, such as user identity, location, application, and device state, to make granular access decisions. To enforce device compliance, a Conditional Access policy is configured to require that a device be marked as compliant by an MDM solution like Intune before granting access to protected resources. This directly controls access based on the device's adherence to organizational security standards.

This service is a core component of Microsoft 365 Defender, providing robust protection against sophisticated threats targeting email and collaboration tools. It safeguards against phishing, business email compromise (BEC), malware, and other advanced attacks across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. Its integrated detection and response capabilities are essential for protecting user productivity and data within the Microsoft 365 ecosystem.

An incident trigger fires the playbook automatically when Microsoft Sentinel creates the incident, letting the logic app act without manual intervention. This satisfies the requirement to block the attacker's IP for 24 hours automatically, since the playbook runs on incident creation rather than on a schedule or alert.

This option utilizes two distinct grant controls within a Conditional Access policy, directly addressing the requirements. "Require multifactor authentication" ensures users provide a second verification factor, significantly enhancing security at the point of access. Concurrently, "Require terms of use" mandates that users review and explicitly accept a specified document before they are permitted to access the protected resource, directly fulfilling both stated requirements for initial access.

Auto-labeling policies for sensitivity labels are specifically engineered to automatically apply predefined labels to content, such as documents and emails, based on conditions like the presence of sensitive information types, keywords, or trainable classifiers. This automated process ensures consistent and scalable data classification across an organization without requiring manual user intervention. Once applied, these labels enable persistent protection and governance actions, regardless of where the data resides or travels.

Sensitivity labels with container management in Microsoft Purview are specifically designed to classify and protect data by applying predefined policies to content and its containers. When a sensitivity label is applied to a Microsoft Teams, SharePoint site, or Microsoft 365 Group, it can automatically enforce specific sharing and access policies, including blocking external sharing for all content within that labeled container. This ensures that data belonging to a particular department or project, once labeled, adheres to predefined organizational sharing restrictions, providing granular control at the container level.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and cloud apps. A DLP policy configured with a rule to detect credit card numbers (a sensitive information type) can automatically block sharing attempts, notify users, or encrypt content, thereby preventing unauthorized data exfiltration. This directly addresses the requirement to block sharing of sensitive data.

Data Lifecycle Management, specifically through Microsoft 365 retention policies and retention labels, is the precise solution for enforcing long-term data retention requirements. Retention policies can be applied broadly to Exchange mailboxes to ensure all customer service emails are preserved for a specified duration, such as seven years, preventing both accidental and malicious deletion by users. These policies also manage the automatic deletion of content after its retention period expires, ensuring compliance with regulatory and organizational data lifecycle mandates.

This solution directly addresses the issue of excessive false positives by allowing legitimate administrative and service accounts to perform necessary admin consent grants without triggering alerts. By explicitly excluding these known, authorized entities, the rule focuses on detecting anomalous or unauthorized consent grants from potentially compromised user accounts or malicious actors. This targeted approach significantly reduces alert fatigue, enabling security analysts to concentrate on high-fidelity alerts that indicate actual threats.

The principle of least privilege dictates that users and systems should only be granted the minimum necessary permissions to perform their legitimate functions. By configuring firewall rules to restrict Remote Desktop Protocol (RDP) access exclusively to a hardened jump server, the security team ensures that direct administrative access to sensitive internal resources is severely limited. This prevents unauthorized lateral movement and reduces the attack surface, aligning precisely with the goal of minimizing potential harm from compromised credentials or systems.

Microsoft Entra ID natively provides robust multifactor authentication (MFA) capabilities, allowing organizations to enforce an additional layer of security beyond just a password. Users can verify their identity through various methods like authenticator apps, biometrics, or security keys, significantly reducing the risk of unauthorized access from compromised credentials. This capability is central to a strong identity and access management strategy within the Microsoft cloud ecosystem.

Microsoft Entra ID Access Reviews enable organizations to efficiently manage group memberships, access to applications, and role assignments by creating recurring review campaigns. These campaigns empower designated reviewers, often resource owners, to periodically attest to the continued need for access for each member. Upon completion of the review period, Access Reviews can automatically remove users whose access was not approved, ensuring the principle of least privilege and reducing stale access. This directly addresses the need for periodic review and removal of access.

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and protection across all cloud applications, both sanctioned and unsanctioned. It actively monitors user activities, including file downloads and uploads, across third-party SaaS applications, detecting anomalous behaviors like mass downloads that could indicate data exfiltration. This solution is specifically engineered to identify and respond to threats within the cloud app ecosystem, making it ideal for detecting when a user downloads a file from a cloud service.

Microsoft Purview Data Map provides a unified metadata store that automatically scans, classifies, and maps data across an organization's hybrid data estate, including on-premises, multi-cloud, and SaaS sources. This capability is fundamental for GDPR compliance as it enables organizations to discover where personal data resides, understand its lineage, and identify sensitive information types, which is crucial for fulfilling data subject access requests and demonstrating accountability.

In Azure AD Conditional Access, the "Conditions" section allows administrators to define specific criteria for policy application. The "Client apps" condition specifically targets the type of client application attempting to access resources, including options to block "Other clients," which encompasses legacy authentication protocols like POP3, IMAP, SMTP, and older Office clients. By selecting this option, organizations can enforce the exclusive use of modern authentication clients, significantly enhancing security by eliminating vulnerabilities associated with less secure, basic authentication methods.

Azure AD B2B collaboration allows organizations to securely invite external users, such as partners, vendors, or customers, to access their applications and resources while letting these users sign in with their own identities. This includes identities from other Azure AD tenants, social identity providers (like Google or Microsoft accounts), or even email one-time passcodes. It provides a streamlined and secure method for external users to access shared resources without creating new credentials in the inviting organization's directory, maintaining strong security controls and compliance.

This option accurately describes a Kusto query that would use `where AlertSeverity == 'High'` to filter, then `summarize DistinctDevices = dcount(DeviceName) by AlertTitle`, and finally `top 10 by DistinctDevices desc` to achieve the stated goal. The use of `dcount(DeviceName)` correctly calculates the number of unique devices affected by each alert title, directly matching the 'distinct affected devices' requirement. Grouping by `AlertTitle` ensures the ranking is based on alert types, providing the top 10 most impactful alert titles.

Automated investigation and response is a core Defender XDR capability, letting the platform triage alerts and execute remediation actions across endpoints, identities and email automatically. This satisfies the stem's requirement for a genuine cross-workload XDR feature rather than a single-product tool.

Disabling the account in Microsoft Entra ID immediately blocks all sign-ins and token issuance, halting the internal phishing campaign at the identity layer. This contains the threat fastest while leaving the mailbox, audit logs and sign-in history intact for forensic investigation, satisfying the preserve-evidence constraint.

Microsoft Sentinel automated response playbooks, built on Azure Logic Apps, are specifically designed for Security Orchestration, Automation, and Response (SOAR). They can be triggered by Sentinel incidents or alerts to execute predefined workflows, such as calling the Microsoft Graph API to disable a user account in Microsoft Entra ID and initiate a password reset. This provides an immediate, automated, and scalable response to detected threats, directly addressing the requirement for revoking user access and resetting passwords without human intervention.

While Azure App Service provides the platform, the customer retains full responsibility for managing user identities and controlling access to their custom web application. This includes implementing authentication mechanisms (e.g., integrating with Azure AD, OAuth, or custom identity providers), defining authorization policies, and assigning appropriate roles to users. Microsoft provides the tools and services, but the customer configures and enforces who can access their specific application, which is a key aspect of 'security in the cloud'.

The shared responsibility model clearly delineates security responsibilities between the cloud provider (Microsoft) and the customer. In IaaS, the customer manages more (applications, data) while the provider secures the physical layer; in PaaS/SaaS, the provider takes on more responsibility.

Sensitivity labels allow organizations to classify and protect data at the document or email level directly by users. When applied, these labels enforce predefined protection actions such as encryption, visual markings (headers, footers, watermarks), and access restrictions, ensuring that sensitive information is handled appropriately throughout its lifecycle, even when shared externally.

Integrity ensures that data is authentic, accurate, and has not been modified or tampered with since it was last verified. Hashing generates a unique, fixed-size digital fingerprint of the financial reports. If even a single bit of the report is altered, the recomputed hash will be drastically different, immediately signaling unauthorized modification or corruption. Comparing the stored hash with a newly generated hash directly verifies that the file content remains unchanged and authentic.

Conditional Access policies in Microsoft Entra ID are the primary mechanism for enforcing granular access controls based on specific conditions. These policies evaluate various signals, such as user or group membership, application being accessed, device state (e.g., compliant or hybrid joined), and location, to determine whether to grant access, block access, or require additional authentication like multi-factor authentication (MFA) or a compliant device. This directly addresses the need to enforce a policy based on group membership and device compliance for application access.

Actions are the core component of a Microsoft Purview DLP policy that dictates the response when content matches the defined conditions. These actions can include blocking access to the content, notifying users or administrators, encrypting the data, or applying retention labels. For instance, a DLP policy might be configured to block sharing of documents containing sensitive data externally and simultaneously send an alert to the security team. This directly addresses what happens when a DLP match occurs.

Microsoft Entra ID Protection's sign-in risk policy directly evaluates the risk associated with a specific sign-in attempt in real-time. When configured to block access for a detected risk level, such as 'High,' it prevents the user from completing the sign-in immediately. This directly addresses the requirement to automatically block a high-risk sign-in, ensuring immediate protection against potentially compromised credentials and unauthorized access.

This statement accurately describes the policy's intended behavior. The conditional access policy is configured to evaluate the "sign-in risk level" condition, specifically targeting "High" risk as detected by Azure AD Identity Protection. When a sign-in attempt is classified as having a high sign-in risk, the policy's grant control, which is set to "Block access," will prevent the user from completing the authentication process.

A Decentralized Identifier (DID) is the foundational element for an organization to act as an issuer in Microsoft Entra Verified ID. This globally unique, self-owned identifier is published to a decentralized ledger (e.g., ION) and contains the public keys and service endpoints necessary for cryptographic operations, such as signing verifiable credentials. The DID cryptographically anchors the organization's verifiable identity, enabling holders and verifiers to trust the authenticity and integrity of the credentials issued.

The Azure Monitor Agent (AMA) is the primary agent for collecting logs and performance data from virtual machines and physical servers, including those located on-premises. It replaces the legacy Log Analytics agent (MMA) and offers enhanced security, cost management, and multi-homing capabilities. AMA sends this collected data directly to a Log Analytics workspace, which serves as Sentinel's data repository for analysis and threat detection.

Microsoft Defender for Cloud provides comprehensive security posture management and threat protection for Azure resources, including virtual machines. It offers Just-in-Time (JIT) VM access, which significantly reduces the attack surface by locking down inbound traffic to VMs and only opening necessary ports for a limited, controlled period. Furthermore, its File Integrity Monitoring (FIM) capability continuously monitors operating system files, application files, and registry keys for suspicious modifications, alerting administrators to unauthorized changes that could indicate a compromise or misconfiguration.

An auto-labeling policy in Microsoft Purview Information Protection is specifically designed to automatically detect sensitive information types, such as passport numbers, within content stored in SharePoint, OneDrive, or Exchange. Upon detection, the policy can then apply a pre-configured sensitivity label to the document or email, ensuring consistent classification and protection without requiring any user intervention. This capability directly addresses the need for automatic application of labels based on specific data patterns.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It ingests security data from virtually any source, including users, devices, applications, and infrastructure, across multi-cloud and on-premises environments. Sentinel then uses AI and machine learning to detect advanced threats, investigate incidents, and automate responses, providing comprehensive threat detection and response capabilities.

Rights management in Microsoft Purview Information Protection applies encryption and usage restrictions that travel with the content, enforcing access even after files leave the tenant. This satisfies the stem by naming a core capability that protects data wherever it resides.

Configuring 'Remember MFA' settings, typically through the 'Sign-in frequency' control within a Conditional Access policy, allows administrators to specify how often users are prompted for MFA. By setting a longer duration, such as 90 days, users on trusted devices can remain authenticated without repeated MFA challenges for that period. This balances security with user experience by reducing prompt fatigue while maintaining strong authentication.

Integrity ensures that data remains accurate, complete, and has not been modified or tampered with by unauthorized parties. Digital signatures achieve this by generating a unique cryptographic hash of the document's content, which is then encrypted with the signer's private key. Any subsequent alteration to the document, even a single character, will cause a mismatch between the recomputed hash and the decrypted hash from the signature, thereby immediately indicating that the record's integrity has been compromised.

Microsoft Purview eDiscovery (Premium) is the comprehensive solution designed for managing legal, regulatory, and internal investigations. It provides an end-to-end workflow that includes placing legal holds on content, such as all Exchange Online mailboxes, to prevent alteration or deletion. This capability ensures that all relevant data is preserved, collected, reviewed, and exported in a defensible manner for litigation purposes, directly addressing the need to preserve content.

Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution for managing HR documents. It allows the creation of retention labels and policies that automatically retain content for a specified period, preventing premature deletion or modification by users. Once the retention period expires, these policies can then automatically initiate the deletion of the content, ensuring compliance with data retention schedules and organizational policies.

Microsoft Sentinel playbooks are built on Azure Logic Apps. Logic Apps provide a visual designer and connectors to hundreds of services, enabling automated workflows. To automate incident response, you create a Logic App and then associate it with an analytics rule in Sentinel. This is the correct component for building playbooks.

Advanced hunting is a powerful, proactive threat hunting tool within Microsoft 365 Defender that allows security analysts to explore raw organizational data using Kusto Query Language (KQL). It aggregates data from endpoints, email, identity, and cloud apps, enabling custom queries to uncover sophisticated threats, identify anomalous behaviors, and correlate events across diverse security domains that automated systems might miss. This capability is crucial for deep investigations and creating custom detection rules.

Safe Links is a critical component of Microsoft Defender for Office 365 that provides time-of-click protection against malicious URLs. It dynamically rewrites URLs in emails and Office documents, then scans them in real-time when a user clicks, blocking access to known malicious sites or warning the user if the link's destination has changed to become malicious since initial delivery. This proactive scanning helps prevent users from accessing compromised websites, even if the link was initially benign.

Compliance Manager performs automated testing of controls against your Microsoft 365 environment, continuously assessing configurations and comparing them with regulatory standards. This satisfies the requirement by identifying which controls pass or fail without manual evidence collection, feeding results into the compliance score.

Microsoft Entra ID Governance Lifecycle Workflows provide automated identity lifecycle management, enabling organizations to define and execute tasks based on HR-driven events like joining, moving, or leaving. This feature can automatically provision or deprovision access to applications and resources, ensuring that when an employee departs, their access is systematically revoked without manual intervention, aligning directly with the requirement to remove access based on HR events.

Microsoft Defender for Cloud's regulatory compliance dashboard is specifically designed to help organizations meet various industry and regulatory standards. It continuously assesses the compliance posture of resources against built-in and custom compliance standards, such as Azure Security Benchmark, PCI DSS, ISO 27001, and HIPAA. The dashboard provides a centralized view of compliance status, offering actionable recommendations and remediation steps to address non-compliant controls and improve overall adherence to regulatory requirements. This direct alignment with compliance frameworks makes it the ideal tool for assessing regulatory posture.

The 'Change status to Closed' action is the direct and appropriate method within Microsoft Sentinel to formally conclude an incident investigation. This action explicitly updates the incident's lifecycle state, marking it as resolved and no longer requiring active attention from analysts. It is commonly utilized within automation rules or playbooks to automatically close incidents that meet specific criteria, such as after a period of inactivity, successful remediation, or identification as a false positive.

Microsoft Entra Identity Governance Access Reviews enable organizations to manage the lifecycle of user access, particularly for guest accounts. They facilitate periodic reviews by resource owners or managers to certify continued access, ensuring compliance and security. These reviews can be automated to remove access for users who are not re-approved or have shown no activity for a defined period, directly addressing the need for guest account management and cleanup. This capability is crucial for maintaining a clean and secure identity posture by preventing stale accounts.

This option accurately describes a common security analysis scenario. A KQL query designed to identify users with a high total number of logon attempts to Microsoft Teams, coupled with a significant count of failed sign-ins for the same user, strongly indicates a potential brute-force attack. This correlation is crucial as it highlights malicious actors repeatedly trying to guess credentials, distinguishing it from legitimate user errors or occasional failed attempts.

Azure AD Identity Protection's primary function involves identifying various identity-based risks in real-time through sophisticated machine learning and heuristics. This includes detecting suspicious activities such as sign-ins from anonymous IP addresses, impossible travel scenarios, or the use of leaked credentials found on the dark web. These granular risk detections are crucial for understanding potential compromises and informing subsequent security actions.

Microsoft Defender for Cloud Apps provides Cloud Discovery capabilities to identify and assess shadow IT within an organization. This feature analyzes network traffic logs from firewalls and proxies to discover all cloud applications being used, including those not explicitly sanctioned by IT. It then provides risk assessments for these discovered apps, enabling organizations to gain visibility and control over their cloud app landscape.

Trainable classifiers use machine learning to identify content by example rather than fixed patterns, automatically classifying documents that fit a trained category. This satisfies the stem's requirement for automatic classification and protection of sensitive data in documents.

Microsoft Purview eDiscovery (Advanced) is the correct solution for internal investigations requiring efficient document review. It incorporates advanced machine learning capabilities, such as predictive coding (also known as Technology Assisted Review or TAR), to intelligently identify and prioritize relevant documents from vast, unstructured data sets. This significantly accelerates the review process by reducing the volume of data human reviewers must examine, ensuring legal teams can focus on the most pertinent information for their case.

Microsoft Entra ID Protection is the dedicated service for detecting identity-based risks, including both sign-in risk and user risk, using adaptive machine learning and heuristics. It continuously monitors sign-in attempts and user behavior for anomalies like impossible travel, unfamiliar sign-in properties, or leaked credentials. Based on these detections, Identity Protection can automatically trigger responses such as requiring multi-factor authentication, enforcing a password change, or blocking access, thereby directly addressing the need for risk-based MFA.

Device platform is a fundamental condition in Microsoft Entra Conditional Access, enabling administrators to specify which operating systems a policy applies to. This condition allows for highly granular control, such as requiring compliant devices only for specific platforms like iOS and Android, while potentially blocking access from less secure or unsupported platforms like Linux or macOS unless they meet additional criteria. It directly evaluates the OS of the device initiating the access request.

Microsoft Purview Insider Risk Management is the correct solution as it proactively identifies, analyzes, and acts on risky activities within an organization. It leverages machine learning and adaptive analytics to detect potential data exfiltration, intellectual property theft, and policy violations by employees, assigning risk scores and automatically generating cases for investigation by security teams. This capability directly addresses the need to identify and monitor potentially risky insider activities.

Microsoft Defender for Identity is specifically designed to monitor on-premises Active Directory (AD) environments for suspicious activities and advanced threats. Ransomware attacks frequently involve compromising AD credentials for lateral movement and privilege escalation. Defender for Identity detects these attacker behaviors, such as Pass-the-Hash, Golden Ticket attacks, or unusual account access patterns, by analyzing network traffic and AD logs, providing crucial early detection against sophisticated ransomware campaigns targeting an organization's core identity infrastructure.

Microsoft Entra ID Conditional Access policies are the core enforcement engine for Zero Trust principles, allowing organizations to define precise conditions under which users can access resources. By incorporating a "sign-in risk" condition, these policies leverage real-time risk assessments from Microsoft Entra ID Protection. If the sign-in risk meets a predefined threshold, the policy can dynamically enforce specific controls, such as requiring multi-factor authentication (MFA) or blocking access, directly aligning with a risk-based Zero Trust model.

When the IsAssigned property for an Intune compliance policy returns False, it directly and unambiguously indicates that the policy has not been targeted or deployed to any user groups, device groups, or the entire tenant. For a compliance policy to become active, enforce settings, and report on device or user compliance, it must be explicitly assigned to the relevant scope within Microsoft Intune.

Microsoft Purview eDiscovery provides the functionality to place legal holds on content, ensuring that data relevant to litigation or investigations is preserved and cannot be altered or deleted. These holds are crucial for maintaining the integrity of electronically stored information (ESI) across various Microsoft 365 services, including Exchange mailboxes, SharePoint sites, and Teams. This capability prevents data spoliation, which is essential for regulatory compliance and legal proceedings.

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct service for automatically retaining and deleting content based on an organization's policies and regulatory requirements. It allows administrators to create retention labels and policies that can be applied to content across various locations, ensuring that financial data, for example, is kept for a specific duration and then disposed of appropriately. This directly addresses the need for automated retention scheduling to meet compliance obligations.

Microsoft Purview Records Management is precisely engineered to help organizations meet their legal, business, and regulatory obligations for records retention and disposition, particularly for highly sensitive data like patient records. This solution enables the classification of content as a formal record, applying immutable retention labels that prevent modification or deletion, even by administrators, and managing the entire lifecycle from creation to final disposition. It ensures that critical information is preserved according to specific healthcare regulations, providing the necessary legal defensibility and compliance.

Conditional Access policies provide the precise control needed to block legacy authentication by evaluating various conditions, including the client application used for access. Administrators can configure a policy to specifically target and block client apps that utilize legacy authentication protocols, such as Exchange ActiveSync or 'Other clients' (which often encompasses protocols like POP3, IMAP, and SMTP AUTH). This ensures that only modern authentication methods, which support features like multi-factor authentication, are permitted for accessing corporate resources.

Microsoft Entra Entitlement Management is a core component of identity governance, automating the lifecycle of access to groups, applications, and SharePoint sites. It allows organizations to define access packages, specify approval workflows, and enable self-service requests, ensuring users gain and lose access appropriately and efficiently based on their roles and projects. This capability streamlines the process of granting and revoking access, reducing manual overhead and improving compliance.

Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning to establish baseline behavior and detect deviations, such as mass downloads. They can be configured to trigger alerts when activities like download volume significantly exceed a user's normal pattern. This directly addresses the requirement to detect unusual data downloads.

Microsoft Authenticator's passwordless sign-in feature allows users to authenticate to Azure AD-connected services by simply approving a notification on their registered mobile device, eliminating the need to type a password. This method leverages public-key cryptography, where the user's mobile phone acts as a secure authenticator, providing a convenient and phishing-resistant multi-factor authentication experience. It is a primary example of a passwordless method delivered through a dedicated mobile application.

Data Loss Prevention (DLP) is the correct solution as it proactively identifies, monitors, and protects sensitive information across Microsoft 365 services, including SharePoint. DLP policies leverage sensitive information types, trainable classifiers, and exact data match to automatically detect specific content (e.g., PII, credit card numbers). Upon detection, DLP can enforce various actions, such as blocking sharing, encrypting files, or notifying administrators, thereby preventing unauthorized disclosure and protecting sensitive data.

Microsoft Entra ID Protection actively monitors public and dark web sources for compromised user credentials associated with your tenant. When a username and password pair is found to be leaked, ID Protection flags the affected user as having a "leaked credentials" risk, enabling administrators to force password resets or block sign-ins to prevent unauthorized access. This proactive monitoring is a critical defense against credential stuffing attacks.

Microsoft Entra Self-Service Password Reset (SSPR) is the correct solution because it directly addresses the need for users to reset their own passwords without requiring administrator intervention. This feature allows users to verify their identity using pre-registered authentication methods, such as mobile app notifications, phone calls, or email verification, to securely regain access to their accounts. SSPR significantly reduces helpdesk call volumes related to password resets and improves user productivity by providing immediate self-service access restoration.

Microsoft Entra Application Proxy enables secure remote access to on-premises web applications from any device, without requiring a VPN or opening inbound firewall ports. It works by deploying a lightweight connector within the private network that establishes an outbound connection to the Microsoft Entra service. This allows users to access internal applications using their Microsoft Entra ID credentials, benefiting from single sign-on and Microsoft Entra's robust security features like Conditional Access.

Periodic access reviews by data owners certify that each user retains only the permissions their job requires, removing accumulated excess rights. This directly enforces least privilege by continuously validating and revoking unnecessary entitlements rather than granting standing access.

Conditional Access policies are the primary method in Microsoft Entra ID to enforce specific access requirements, such as multifactor authentication (MFA), based on various conditions like user location, device state, or application being accessed. These policies evaluate conditions in real-time and grant or block access, or require additional steps like MFA, ensuring robust security tailored to risk.

Microsoft Entra External ID is purpose-built as a robust Customer Identity and Access Management (CIAM) solution, specifically engineered to manage identities for millions of external customers accessing applications and services. It natively supports a wide array of identity providers, including popular social accounts (e.g., Google, Facebook), enterprise accounts, and local accounts. Furthermore, it offers extensive customization capabilities for sign-up, sign-in, and profile management pages, ensuring a fully branded and user-friendly experience tailored for external customers.