Question

You are the Microsoft 365 administrator for Contoso. Microsoft Entra ID Protection has flagged a user account as 'High' risk after detecting leaked credentials on the dark web. You need to allow the user to regain access with the least administrative effort while ensuring the compromised password can no longer be used. What should you do?

Accepted Answer

Have the user perform a self-service password reset (SSPR), which automatically remediates and dismisses the user risk once completed with MFA.

Answer

In the Entra admin center, select the user under Risky users and choose 'Dismiss user risk' without changing the password.

Answer

Delete the user account and recreate it with a new password to clear the leaked credential detection.

Answer

Block the user's sign-in indefinitely and wait for Entra ID Protection to automatically lower the risk level.