Question

Contoso uses Entra ID Protection. A user-risk-based Conditional Access policy requires users with 'high' user risk to perform a secure password change. A security analyst reviews a flagged account and, after investigation, confirms the sign-ins were legitimate activity by the actual user (a false positive). The analyst wants to clear the risk state so the account is no longer treated as high-risk, without forcing the user to change their password. Which action should the analyst take in the Entra admin center?

Accepted Answer

Select the user under Risky users and choose 'Dismiss user risk'.

Answer

Select the user under Risky users and choose 'Confirm user compromised'.

Answer

Select the user under Risky users and choose 'Reset password'.

Answer

Block the user's sign-in from the user's profile until the next sign-in cycle.