Question

You administer Microsoft Entra ID Protection for Contoso. A user account was flagged after impossible-travel and anonymous-IP detections during recent sign-ins, but there is no indication the account's credentials have been compromised over time. You want a Conditional Access policy that responds specifically to the elevated likelihood that THIS particular authentication attempt is fraudulent, prompting for MFA before granting access. Which risk-based Conditional Access policy should you configure?

Accepted Answer

A sign-in risk policy that requires multifactor authentication when sign-in risk is Medium or High

Answer

A user risk policy that requires a secure password change when user risk is High

Answer

A user risk policy that blocks access when user risk is Medium or High

Answer

A sign-in risk policy that blocks access when sign-in risk is Low or above