Question

A financial services company uses Microsoft Entra ID P2. Security requires that employees signing in from unfamiliar locations or exhibiting anomalous behavior be automatically challenged with additional verification, while low-risk sign-ins from managed devices proceed with minimal friction. The solution must react dynamically to Microsoft's real-time risk scoring without administrators manually maintaining IP lists. Which approach should you recommend?

Accepted Answer

Configure a Conditional Access policy that uses Entra ID Protection sign-in risk as a condition and requires MFA when the risk level is medium or high

Answer

Create a Conditional Access policy with named locations listing all approved office IP ranges and block sign-ins from anywhere else

Answer

Enable Security Defaults for the tenant to enforce MFA for all users on every sign-in

Answer

Deploy per-user MFA and require every employee to register a phone number for verification on all sign-ins