Question

Your organization uses Microsoft Entra ID P2. The security team wants users who trigger a high sign-in risk (for example, an anonymous IP address or atypical travel detection) to be forced to complete multifactor authentication before the session is allowed. If the user cannot satisfy MFA, access must be blocked. Legitimate users must not be permanently locked out. Which approach best meets these requirements?

Accepted Answer

Create a sign-in risk-based Conditional Access policy that requires MFA when sign-in risk is High.

Answer

Create a user risk-based Conditional Access policy that requires a secure password change when user risk is High.

Answer

Configure an Entra Password Protection policy with a custom banned password list.

Answer

Enable security defaults for the tenant to enforce MFA for all users.