Question

Contoso runs several automation service principals that authenticate to Microsoft Graph. Security wants to automatically block any of these workload identities if Entra ID Protection detects that their credentials are being used from an anomalous location or if leaked credentials are found. The solution must apply only to service principals and must not affect interactive users. What should you configure?

Accepted Answer

A workload identity risk-based Conditional Access policy that targets the service principals and blocks access on medium and above risk

Answer

A user risk policy in Entra ID Protection scoped to a group containing the service principals

Answer

A sign-in risk-based Conditional Access policy assigned to All users requiring multifactor authentication

Answer

A Conditional Access policy using an authentication context assigned to the automation applications