Hotspot Question You have a Microsoft 365 tenant. You need to identify users who have leaked credentials. The solution must meet the following requirements: - Identify sign-ins by users who are suspec

Question

Answer Area

• To classify leaked credentials as high-risk, use:Azure Active Directory (Azure AD) Identity Protection
  Azure Active Directory (Azure AD) Identity ProtectionAzure Active Directory (Azure AD) Privileged Identity Management (PIM)Identity GovernanceSelf-service password reset (SSPR)
• To trigger remediation, use:Sign-in risk
  Client apps not using Modern authenticationDevice stateSign-in riskUser locationUser risk
• To mitigate the risk, select:Grant access but require password change
  Apply app enforced restrictionsBlock accessGrant access but require app protection policyGrant access but require password change

• Azure Active Directory (Azure AD) Identity Protection|Client apps not using Modern authentication|Apply app enforced restrictions
  100% (1)

Explanation

This question tests knowledge of Azure AD Identity Protection's risk detection and Conditional Access policies to handle leaked/compromised credentials in Microsoft 365.

Approach. To identify users with leaked credentials, you use 'Azure AD Identity Protection' which has a built-in risk detection called 'Leaked credentials' that flags sign-ins as high-risk events. To immediately enforce a control while still allowing access, you configure a 'User risk policy' (or Conditional Access policy with user risk condition) set to require 'Multi-Factor Authentication (MFA)' or password change - this mitigates the risk in real-time without blocking the user entirely. The three selections would be: (1) Azure AD Identity Protection for the detection mechanism, (2) 'Leaked credentials' as the risk detection type (classified as a high-risk event), and (3) A User Risk Conditional Access Policy requiring MFA/password change as the immediate remediation control that still allows application access.

Concept tested. Azure AD Identity Protection risk detections (specifically leaked credentials as a high-risk sign-in event) and Conditional Access User Risk Policies that enforce MFA or password reset as a real-time remediation action without fully blocking user access to applications.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks