Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 601–675

An anti-phishing policy, especially when configured with SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) settings, is specifically designed to combat phishing attacks. These authentication mechanisms verify the sender's identity and domain legitimacy, preventing spoofed emails and impersonation attempts from reaching recipients. This comprehensive approach directly addresses the core techniques used in phishing by ensuring email authenticity and enforcing policies on unauthenticated messages.

Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security or MCAS) functions as a Cloud Access Security Broker (CASB). It provides comprehensive visibility into cloud applications, both sanctioned and unsanctioned (shadow IT), across an organization's network. By leveraging traffic logs from firewalls and proxies, it discovers all cloud apps, assesses their risk based on over 80 factors, and enables granular control over data and user activities within sanctioned applications to enforce security policies and prevent data leakage. This makes it ideal for managing the security posture of cloud app usage.

When an application's client secret reaches its expiration date, it becomes invalid and can no longer be used to authenticate with Azure Active Directory. Any attempt by the application to acquire an access token using this expired secret will result in an authentication failure. This prevents the application from accessing protected resources or performing actions on behalf of itself.

Sign-in risk detection evaluates each authentication attempt using signals like anonymous IP use, atypical travel and unfamiliar sign-in properties, then assigns a risk level. This gives Microsoft Entra ID Protection the per-session risk signal that Conditional Access policies consume to challenge or block suspicious sign-ins.

Conditional Access policies in Azure AD evaluate various signals, including user, location, application, and device state, at the time of a sign-in attempt. These policies can specifically enforce requirements such as a device being marked as compliant by Microsoft Intune or being hybrid Azure AD joined, before granting access to Microsoft 365 cloud applications like Exchange Online or SharePoint Online. This directly addresses the need to control access based on specific device compliance criteria.

eDiscovery (Premium) is specifically designed to manage large-scale, complex litigation and regulatory investigations by offering an end-to-end workflow within Microsoft Purview. It extends beyond Standard capabilities with advanced features like custodian management, legal hold orchestration, and collection from non-Microsoft 365 sources. Crucially, it incorporates machine learning-driven analytics, including predictive coding (TAR), near-duplicate detection, and email threading, which significantly streamline the review process, reduce data volumes, and lower legal costs for extensive document sets.

Microsoft Entra Identity Protection is the dedicated service for detecting, investigating, and remediating identity-based risks. A user risk policy within Identity Protection continuously monitors for suspicious activities, such as leaked credentials or impossible travel, to calculate a user's aggregate risk level. When this risk level crosses a configured threshold, the policy can be set to automatically block the user's sign-in attempt, directly fulfilling the requirement to prevent high-risk users from accessing resources.

Azure AD Conditional Access serves as the policy engine for enforcing access controls based on specific conditions, making it the correct solution for IP-based restrictions. Administrators can define 'named locations' using public IP address ranges or country/region lists, then create policies that grant or block access if users are signing in from these specified locations. This allows precise control over who can access resources from particular network segments, directly addressing the company's requirement for IP-specific access.

Conditional Access evaluates device compliance state signalled by Intune and grants or blocks access to corporate resources accordingly. This enforces the requirement that only compliant devices connect, which device compliance policies alone cannot do since they merely report state.

Refining the policy conditions within Microsoft Purview Communication Compliance is the most effective and technically sound solution to reduce false positives while preserving the policy's intended protective scope. This involves precisely adjusting keywords, phrases, dictionaries, or even excluding specific users or groups known to generate benign matches, thereby ensuring the policy accurately targets genuine compliance risks without generating unnecessary alerts and administrative overhead.

Automation rules in Microsoft Sentinel are specifically designed to orchestrate responses to security incidents. By configuring an automation rule to trigger upon incident creation, it can then execute a pre-defined playbook (an Azure Logic App). This playbook can contain various actions, such as sending a notification to a Microsoft Teams channel, thereby automating the initial communication and response for new incidents.

Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities specifically for Azure Kubernetes Service (AKS). It offers continuous security recommendations for AKS configurations, scans container images for vulnerabilities, and detects runtime threats within the cluster, including suspicious activities at the pod and node level, making it the primary tool for securing Kubernetes.

Microsoft Defender for Cloud is the correct solution as it provides comprehensive security posture management and threat protection across hybrid and multi-cloud environments. It natively performs vulnerability assessments for Azure virtual machines and on-premises servers, integrating with Azure Arc to extend its capabilities. This service offers continuous monitoring, security recommendations, and compliance management, directly addressing the need for OS-level vulnerability scanning and configuration recommendations.

The correct column might be 'AlertName' but some tables use 'Title'.

Deploying password writeback, a feature of Microsoft Entra Connect, allows users to reset or change their Microsoft Entra ID password and have that new password synchronized back to their on-premises Active Directory account. This ensures password consistency across the hybrid environment and enables cloud-initiated password management for on-premises accounts. Concurrently, enabling Microsoft Entra smart lockout protects user accounts from brute-force attacks by intelligently locking out malicious actors while allowing legitimate users to continue accessing their accounts, specifically preventing lockouts in Microsoft Entra ID.

Microsoft Defender XDR fuses signals from endpoints, identities, email and cloud apps, correlating related alerts into one incident so analysts see the full attack story. This cross-domain correlation is the core capability distinguishing it from standalone Defender workloads.

Auto-labeling policies in Microsoft Purview are powerful tools that automatically apply sensitivity labels to content based on predefined conditions. These conditions often include the detection of specific sensitive information types, keywords, or regular expressions within documents and emails. By automatically assigning labels, these policies effectively classify data at scale, ensuring consistent application of classification without requiring manual user intervention.

Automatic classification based on sensitive content is a cornerstone feature of Microsoft Purview Information Protection. This capability leverages sensitive information types, trainable classifiers, and exact data match to automatically identify and categorize sensitive data across various locations, including documents, emails, and cloud services. By proactively classifying content, Information Protection can then apply appropriate sensitivity labels and protection actions, significantly reducing the manual effort required to secure vast amounts of organizational data.

Microsoft Defender for Endpoint incorporates automatic alert suppression mechanisms designed to combat alert fatigue within security operations. When the system detects multiple instances of the exact same threat or activity on a device within a short timeframe, it intelligently suppresses subsequent duplicate alerts. This ensures security analysts can focus on unique, high-fidelity threats rather than being overwhelmed by redundant notifications, streamlining incident response.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It provides comprehensive capabilities for collecting security data from diverse sources, including Microsoft services, other cloud providers, and on-premises infrastructure. Sentinel leverages AI and machine learning for threat detection, investigation, and automated response, making it the ideal platform for monitoring and responding to security threats across an entire enterprise environment.

Sensitivity labels, when configured with encryption, apply rights management protection to documents. This protection can explicitly define which users or groups have specific access rights, such as view-only, edit, or full control. If a user reports being unable to access a sensitive document, it is highly probable that the label's encryption settings have been configured to restrict access to a specific set of authorized individuals, and the reporting user is not included in that authorized list. This is a fundamental capability of Microsoft Purview Information Protection.

Microsoft Purview Data Lifecycle Management (DLM) is specifically designed to help organizations manage their data throughout its entire lifecycle, including long-term preservation. Creating a retention policy to keep financial records for a specified duration, such as seven years, is a fundamental capability within DLM. These policies ensure compliance with legal, regulatory, and business requirements by preventing premature deletion and ensuring data availability.

The customer retains primary responsibility for managing user identities and controlling access within the SaaS CRM application. This involves provisioning user accounts, assigning appropriate roles and permissions, and configuring authentication methods, often integrating with their own corporate identity provider like Azure Active Directory. This ensures that only authorized personnel can access specific CRM functionalities and data, aligning with the principle of least privilege.

Creating an app discovery policy with a governance action to unsanction the app is the correct and most automated method. This policy allows Microsoft Defender for Cloud Apps to continuously scan discovered applications based on defined criteria (e.g., risk score, category, usage patterns). When an app matches the policy, the configured governance action, such as 'Unsanction app,' automatically marks it as unauthorized and triggers enforcement mechanisms, effectively blocking its use across the organization.

Microsoft Purview Compliance Manager is the dedicated solution for simplifying compliance and reducing risk by providing pre-built assessments for common industry regulations, such as HIPAA. It allows organizations to track progress on improvement actions, assign responsibilities, and generate detailed compliance reports, offering a measurable compliance score. This service directly addresses the need to demonstrate and manage an organization's adherence to regulatory requirements through a structured workflow.

This is the most efficient and cloud-native solution. A dynamic group in Microsoft Entra ID can be configured with a rule (e.g., user.manager -ne null) to automatically include all users who have a manager assigned, ensuring membership is always up-to-date. This dynamic group can then be directly targeted by a Conditional Access policy, allowing granular control over application access or other security requirements for this specific user population.

Trainable classifiers use machine learning, seeded with sample data, to identify content by its actual characteristics rather than keyword matches. Training on genuine insider-trading examples sharpens precision, directly satisfying the requirement to minimise false positives across Exchange and Microsoft Teams messages.

The command Get-AzureADGroupMember successfully retrieves all direct members of the Azure AD group specified by its object ID. Piping this output to Select-Object DisplayName, UserPrincipalName then precisely extracts and displays only the user's friendly name and their unique sign-in identifier. This combination accurately fulfills the objective of reporting specific identity attributes for each member of the Sales group.

Microsoft Purview Audit logs and retains user and administrator activities across Microsoft 365 services, including Exchange Online, SharePoint Online, and Microsoft Entra ID. It provides a unified audit log that compliance officers can search to investigate incidents such as data leaks. Standard audit retention is 90 days, which matches the investigation window, making it the correct tool for reviewing activity history.

Eligible assignment with no end date, approval required, activation max 1 hour.

Lifecycle workflows in Microsoft Entra ID Governance automate joiner, mover, and leaver processes. For a leaver, you can configure a workflow that disables the account and revokes access to all applications immediately upon triggering. This directly addresses the requirement by automating offboarding tasks, ensuring no residual access remains. It is the correct capability for this scenario.

Azure Policy definitions, particularly for custom assessments, require the `supportedClouds` property (plural) to correctly specify the cloud environments where the policy should be active. The exhibit incorrectly uses `supportedCloud` (singular), which is not a recognized property in the Azure Policy schema. Furthermore, this property is expected to be an array of strings, even if only one cloud is specified, ensuring proper schema validation and deployment. This specific misnaming and incorrect data type are critical errors preventing successful deployment.

Microsoft Purview Audit (Standard) is specifically designed with a fixed retention period of 90 days for all audit logs. This means that any audit records generated will be automatically retained for exactly 90 days from their creation date. After this 90-day window expires, these logs are automatically and permanently purged from the system, making them irretrievable. This inherent limitation is a primary reason why older audit logs might appear to be missing.

Sensitive information types (SITs) are the fundamental building blocks in Microsoft Purview for automatically identifying sensitive data. They define specific patterns, keywords, regular expressions, and proximity rules that the system uses to detect particular types of sensitive information, such as credit card numbers, national identification numbers, or medical record numbers. This automatic pattern matching is precisely how Purview discovers and classifies data at scale, making SITs the direct answer to automatic classification.

A Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is specifically engineered to identify, monitor, and protect sensitive information sent via email. These policies utilize sensitive information types, keywords, and content matching to detect specific data patterns, such as credit card numbers or national ID numbers, within email messages and attachments. Upon detection, the policy can enforce actions like blocking the email, encrypting it, or notifying administrators, directly preventing unauthorized data egress.

The principle of least privilege dictates that every user, program, and process should be granted only the minimum necessary permissions to perform its legitimate function. This approach significantly reduces the attack surface by limiting the potential damage an attacker can inflict if an account or system is compromised. By restricting access to only what is essential, it minimizes the risk of unauthorized actions and data breaches, aligning directly with the scenario described.

Implementing the security recommendations provided by Microsoft Defender for Cloud directly addresses identified vulnerabilities and misconfigurations within your Azure environment. Each recommendation, when remediated, contributes points towards your secure score, reflecting an improved security posture by aligning resources with best practices and security controls. This is the primary mechanism for actively enhancing the secure score and reducing your attack surface.

Microsoft Purview Communication Compliance is specifically designed to help organizations detect and remediate regulatory compliance violations, such as insider trading, harassment, or sensitive data sharing, within their internal and external communications. It uses intelligent templates and customizable policies to proactively scan messages across Microsoft 365 services for specific keywords, sensitive information types, or patterns indicative of policy breaches. Compliance officers can then review, investigate, and take action on identified risky communications through a dedicated workflow.

Microsoft Purview Communication Compliance is specifically designed to help organizations review messages for potential regulatory compliance violations. It enables the creation of policies that scan for specific content, context, or user groups within communications across various platforms, identifying instances that may violate internal policies or external regulations such as FINRA, HIPAA, or GDPR. The primary goal is to detect and facilitate the review of such communications by designated compliance investigators.

Self-Service Password Reset (SSPR) directly enables users to reset their forgotten or expired passwords independently, significantly reducing help desk calls. When combined with password protection policies, which are a feature of Microsoft Entra ID, the system enforces rules such as preventing the reuse of a specified number of previous passwords. This combination effectively addresses both requirements: empowering users for self-service and maintaining strong password hygiene through history enforcement.

Identity Protection is a core capability within Microsoft Entra ID that focuses on detecting, investigating, and remediating identity-based risks. It leverages machine learning and heuristics to identify suspicious activities, such as anomalous sign-ins, leaked credentials, or impossible travel, across user accounts. This feature can automatically block risky sign-ins or enforce multi-factor authentication, significantly enhancing the security posture of user identities within the organization.

An auto-labeling policy for sensitivity labels is the precise mechanism within Microsoft Purview designed to automatically apply sensitivity labels to content that contains specific sensitive information types, such as PII. These policies scan content in designated locations (e.g., SharePoint, OneDrive, Exchange) and, upon detecting PII, automatically apply the configured sensitivity label. This label then enforces the associated protection actions, including encryption, visual markings, and access restrictions, thereby directly addressing the requirement to label and protect.

Data Lifecycle Management provides auto-apply retention label policies that can use sensitive information types (SITs) to classify and retain content automatically. This is the correct solution to apply a retention label based on content detection.

Configuring an auto-labeling policy with a sensitive information type for credit card numbers is the most effective and accurate method for automatic protection. This approach leverages Microsoft Purview's built-in capabilities to scan content for specific patterns, keywords, and checksums associated with credit card numbers, then automatically applies the appropriate sensitivity label and its associated protection actions (e.g., encryption, access restrictions) without any user intervention.

Microsoft Entra ID Protection continuously monitors sign-in attempts and user behavior for anomalous activities, such as impossible travel, unfamiliar sign-in properties, or leaked credentials. It assigns a real-time risk score to each sign-in and user, which can then be directly consumed as a condition within Microsoft Entra Conditional Access policies. This allows organizations to enforce adaptive access controls, like multi-factor authentication or blocking access, based on the detected risk level.

Access reviews, a core component of Microsoft Entra Identity Governance, enable organizations to efficiently manage group memberships, application access, and role assignments. They allow administrators or group owners to periodically review who has access to what, and crucially, can be configured to automatically remove users from groups if they fail to attest to their continued need for access or if they are identified as inactive based on sign-in data. This capability directly addresses the requirement to maintain clean group memberships by removing inactive users.

Microsoft Entra Conditional Access allows organizations to create policies that enforce access controls based on conditions such as user, device compliance, location, and risk. It can require compliant devices, trusted locations, and multi-factor authentication for specific scenarios. This precisely matches the requirement to restrict access to compliant devices and trusted locations while enforcing MFA from untrusted networks.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and automatically protect sensitive information across Microsoft 365 services, endpoints, and on-premises repositories. By defining rules based on sensitive information types, labels, or keywords, DLP policies can actively prevent users from sharing files containing sensitive data externally, internally, or to unauthorized applications, thus directly addressing the requirement to block file sharing. These policies enforce controls to stop data exfiltration.

The Microsoft Purview compliance portal audit search provides the native, centralized, and most user-friendly interface for security analysts to query Microsoft 365 audit logs. This dedicated portal allows for comprehensive searching across various services like Exchange Online, SharePoint Online, Teams, and Azure AD, offering extensive filtering capabilities by date, user, activity, and workload. It is specifically designed for investigative purposes, enabling efficient identification of specific user or administrator actions without requiring complex scripting.

Data Lifecycle Management (DLM) effectively establishes a baseline retention policy to retain data for seven years and then automatically delete it, ensuring general compliance with record-keeping regulations. Concurrently, eDiscovery (Premium) allows for the precise application of a legal hold on specific project documents, which critically overrides any deletion policy, including the DLM policy, to preserve evidence for potential litigation. This combination ensures both routine data governance and specific, immutable preservation for legal requirements.

Microsoft Defender for Office 365 is the correct solution as it specifically provides advanced protection against phishing, spam, malware, and other threats delivered via email and collaboration tools like Microsoft Teams. Its key features, Safe Links and Safe Attachments, are designed to perform real-time scanning of URLs and attachments. Safe Links rewrites and scans URLs at the time of click, while Safe Attachments detonates suspicious files in a sandbox environment, directly addressing the need for real-time URL scanning in email and Teams.

Defense in depth is a cybersecurity strategy that employs multiple, independent layers of security controls to protect information and systems. The objective is to ensure that if one security control fails or is bypassed, other controls are in place to prevent or delay a breach, thereby increasing the overall resilience of the system. This layered approach often includes a combination of technical controls like firewalls and intrusion detection systems, administrative controls such as policies and training, and physical controls.

Email & collaboration in Microsoft Defender XDR provides robust, integrated protection for email and collaboration tools like Microsoft Teams, identifying and mitigating threats such as phishing, malware, and spam. It unifies threat investigation and response capabilities across these communication vectors within a single portal, enabling security administrators to proactively defend against sophisticated email-borne attacks and ensure data integrity.

Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables Just-In-Time (JIT) access by allowing users to activate privileged roles only when needed, for a limited duration, and often requiring multi-factor authentication or an approval workflow. PIM also enforces time-bound assignments and provides comprehensive auditing and review capabilities for all privileged role activations, directly addressing the requirement for JIT privileged access management.

Correct. The conditions specify when a policy applies (e.g., when risk is medium or high). Grant controls enforce the required actions: require MFA for medium/high risk and block for high risk. Block access is an available grant control.

The Principle of Least Privilege dictates that users, applications, and systems should be granted only the minimum necessary permissions required to perform their specific job functions or tasks. This fundamental security practice significantly reduces the attack surface by limiting the potential damage an attacker can inflict if an account is compromised or an application is exploited. It directly addresses the need to restrict access to only what is absolutely essential, minimizing unauthorized actions.

Microsoft Entra Connect Sync is the designated on-premises agent responsible for synchronizing user identities, groups, and other objects from an on-premises Active Directory to Microsoft Entra ID. It supports various synchronization features crucial for migration, including password hash synchronization (PHS), which securely transfers a hash of the on-premises password to the cloud, enabling single sign-on for users. This tool is fundamental for hybrid identity scenarios, ensuring a consistent user experience across both environments.

Microsoft Entra Domain Services provides a managed domain environment that is fully compatible with traditional Active Directory Domain Services (AD DS). It offers essential domain services like LDAP, Kerberos, and NTLM authentication, which are critical for legacy applications that cannot be easily re-architected to use modern authentication protocols. This service allows companies to lift-and-shift these applications to the cloud without deploying or managing domain controllers, while still leveraging their existing Microsoft Entra ID identities for authentication and directory lookups.

Information Barriers define policies that block communication and collaboration between specified segments, enforcing restrictions across Exchange email, Microsoft Teams chats, and SharePoint sites. This directly prevents the M&A team and trading desk from contacting each other in any Microsoft 365 channel.

DLP blocks sharing; retention policy retains; sensitivity label provides manual classification with encryption and expiration.

Zero Trust is a modern security model that fundamentally shifts from perimeter-based security to a 'never trust, always verify' approach. It mandates explicit verification for every access request, regardless of whether the request originates inside or outside the traditional network perimeter. This model assumes breach and continuously validates identity, device health, and other contextual factors before granting and maintaining access to resources.

Microsoft Secure Score aggregates your security posture across Microsoft 365 services and surfaces prioritised improvement actions. It satisfies the requirement for a central dashboard showing overall posture and recommended actions, unlike Defender-specific incident views or compliance reports.

A conditional access policy is the correct mechanism because it acts as the enforcement engine, evaluating various signals including the device's compliance status reported by Intune. This policy can be configured to explicitly require that a device be marked as 'compliant' before granting access to specific cloud applications or services. It effectively bridges device health with access control decisions, ensuring only trusted devices can reach sensitive data.

This Conditional Access policy specifically targets legacy authentication clients by including both "Exchange ActiveSync clients" and "Other clients" in its scope. Protocols like IMAP, POP, and SMTP inherently utilize legacy authentication methods, which are encompassed within the "Other clients" category. By targeting these client types, the policy effectively applies its controls to connections made using these older, less secure authentication flows.

Conditional Access policies in Azure Active Directory are the robust control plane for enforcing access decisions to cloud applications, including email, based on various signals. These policies evaluate conditions such as user identity, location, application, and crucially, the device's compliance status as reported by Intune. Based on this evaluation, Conditional Access can grant access, block access, or require additional authentication methods, making it the definitive mechanism for enforcing access control based on device compliance.

Passwordless authentication significantly enhances security by eliminating the primary target for many credential theft attacks: the password itself. By replacing passwords with more secure methods like FIDO2 security keys, Windows Hello for Business, or the Microsoft Authenticator app, organizations remove the risk of passwords being phished, brute-forced, or stolen through credential stuffing. This approach fundamentally reduces the attack surface for identity-based breaches.

Azure AD B2B, now a foundational component within Microsoft Entra External ID, specifically enables organizations to collaborate securely with external partners. It allows guest users from other Microsoft Entra tenants or social identity providers to access applications and resources in your directory using their existing credentials, streamlining external access management. This capability is central to managing external identities for business-to-business scenarios.

This option accurately describes a Microsoft Purview DLP policy configured to prevent data exfiltration. The policy rule is set to detect the presence of 10 or more credit card numbers, identified with a high confidence level, within an email message. Upon this condition being met, the specified action is to block the sending of that email, ensuring sensitive data remains within organizational boundaries.

Purview advanced audit logs represent an enhanced set of auditing capabilities available with specific Microsoft 365 E5 compliance licenses. These logs provide higher fidelity events, such as detailed mailbox item access or eDiscovery search activities, and offer extended audit log retention periods up to 10 years. They are integral to advanced forensic investigations and meeting stringent regulatory compliance requirements, building upon the foundational unified audit log.

Microsoft Purview Insider Risk Management proactively detects and acts on malicious or inadvertent insider activities that could lead to data exfiltration. It leverages machine learning and behavioral analytics across Microsoft 365 services to identify unusual or risky user behaviors, such as downloading large amounts of sensitive data or sharing it externally, providing alerts and enabling remediation actions to prevent data loss.

Cloud Discovery is a core capability of Microsoft Defender for Cloud Apps (MDCA) that analyzes traffic logs from firewalls and proxies to identify all cloud services accessed by users in an organization. It provides comprehensive visibility into shadow IT by detecting unsanctioned cloud applications, assessing their risk levels, and generating reports that help administrators understand usage patterns and potential security or compliance gaps.

Defense in depth is a security strategy that employs a series of layered and overlapping security controls to protect assets. The principle is that if one security control fails or is bypassed, another control will be in place to prevent or detect an attack. This multi-layered approach, encompassing administrative, technical, and physical safeguards, significantly enhances an organization's overall resilience against diverse threats, ensuring no single point of failure compromises security.

An auto-labeling policy for sensitivity labels is specifically configured to automatically detect and apply predefined sensitivity labels to content that matches specific conditions, such as the presence of sensitive information types, keywords, or patterns. This capability directly addresses the need to automatically apply a 'confidential' label, which can then enforce protective actions like encryption, visual markings, and access restrictions, ensuring consistent data protection without manual intervention.

Automation rules are a core component of Microsoft Sentinel's Security Orchestration, Automation, and Response (SOAR) capabilities, enabling automated responses to alerts and incidents. They can be configured to automatically create incidents from incoming alerts, apply specific tags, change the incident status, and assign the incident to a designated owner or group. This direct capability to create and assign incidents makes them the correct choice for streamlining security operations.

Microsoft Entra ID Protection is the correct service for this scenario, as it specializes in detecting identity-based risks, including compromised credentials and suspicious sign-ins. It leverages machine learning to identify user and sign-in risks, and its risk-based policies can be configured to automatically enforce remediation actions. When a high user risk is detected, Identity Protection can be set to require a user to perform a secure password change as a self-remediation step, directly addressing the compromised identity.