Question

Your organization uses Microsoft Entra ID Protection. Security operations reports that legacy authentication protocols are generating a high volume of sign-in risk detections that cannot be challenged with MFA. Leadership wants automated protection that blocks the riskiest sign-ins in real time while allowing medium-risk users to self-remediate, and they want to avoid excessive help desk tickets from false positives at low risk. Which configuration best meets these requirements?

Accepted Answer

Configure a sign-in risk-based Conditional Access policy that blocks access at high risk, requires MFA at medium risk, and add a policy blocking legacy authentication clients.

Answer

Configure a sign-in risk-based Conditional Access policy that requires MFA at low and above, and a separate policy that blocks legacy authentication clients.

Answer

Configure a user risk-based Conditional Access policy that requires a secure password change at high risk and rely on the built-in ID Protection MFA registration policy.

Answer

Configure a single sign-in risk-based Conditional Access policy that requires MFA for all risk levels and enable legacy authentication for backward compatibility.