SC-900 Describe the capabilities of Microsoft Entra Practice Question
Exhibit
Get-AzureADMSIdentityProtectionRiskDetection -Filter "riskEventType eq 'unfamiliarSignInProperties'"
Refer to the exhibit. You run the cmdlet and get a list of risk detections. What does this cmdlet retrieve?
⚠ Common exam trap
It's easy for candidates to confuse retrieving risk detections (which are events) with retrieving risky users or sign-in logs, and they overlook the `-Filter` parameter that narrows the scope to a specific risk event type, leading them to choose the overly broad 'All risk detections' option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk detections for the unfamiliar sign-in properties risk event type
The cmdlet `Get-MgRiskDetection` retrieves all risk detections in the tenant, but when combined with the `-Filter` parameter for `riskEventType eq 'unfamiliarSigninProperties'`, it specifically returns only those risk detections that match the unfamiliar sign-in properties risk event type. This is because the cmdlet supports filtering by the `riskEventType` property, which corresponds to the type of risk detection as defined by Microsoft Entra ID Protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Users who have been flagged for risky sign-ins
Why it's wrong here
The `Get-MSRiskDetection` cmdlet is specifically designed to retrieve risk detection objects generated by Azure AD Identity Protection, not user objects. While these detection objects contain information about the user involved in the risky event, they are distinct from user objects themselves. To retrieve user objects flagged for risk, one would typically use the `Get-MSRiskyUser` cmdlet, which focuses on the user entity rather than the individual risky event.
- ✗
All risk detections in the tenant
Why it's wrong here
This option is incorrect because the cmdlet includes a `-Filter` parameter, which explicitly limits the scope of the results. The filter `riskEventType eq 'unfamiliarSignInProperties'` ensures that only risk detections matching this specific event type are returned. Without this filter, the cmdlet would indeed retrieve all risk detections in the tenant, but its presence restricts the output to a subset.
- ✗
All sign-in logs with unfamiliar properties
Why it's wrong here
The `Get-MSRiskDetection` cmdlet retrieves high-level risk detections, which are security alerts generated by Azure AD Identity Protection's machine learning algorithms, not raw sign-in logs. Raw sign-in logs contain detailed authentication attempts and are typically accessed via the Azure portal's sign-in logs blade or cmdlets like `Get-AzureADAuditSignInLogs`. Risk detections are an analysis of potential risks derived from, but distinct from, the underlying sign-in log data.
- ✓
Risk detections for the unfamiliar sign-in properties risk event type
Why this is correct
This option is correct because the `Get-MSRiskDetection` cmdlet is used to retrieve risk detections from Azure AD Identity Protection. The `-Filter "riskEventType eq 'unfamiliarSignInProperties'"` parameter precisely targets and returns only those risk detection objects where the `riskEventType` property matches 'unfamiliarSignInProperties'. This accurately identifies sign-ins exhibiting characteristics outside a user's typical patterns, as indicated by the specified risk event type.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.