Question

During investigation of a Defender XDR incident, you find a correlated alert from Microsoft Entra ID Protection indicating a user account triggered an 'impossible travel' and an 'anonymous IP address' risk detection within a 10-minute window. The account's risk level is now High, but the user reports no unusual activity. You must contain potential account compromise immediately while preserving the ability to investigate whether the sign-ins were malicious. Which response action best meets this requirement?

Accepted Answer

Mark the user as compromised (confirm user compromised) and require a secure password reset via Conditional Access, keeping the account active for investigation

Answer

Delete the user account in Entra ID to permanently prevent further sign-ins

Answer

Dismiss the user's risk in Entra ID Protection so the alert stops generating noise during investigation

Answer

Disable the device the user last signed in from using Defender for Endpoint isolation