Question

A security analyst at Contoso wants to understand how Microsoft Entra ID Protection evaluates threats. They notice that a single user account triggered alerts based on anonymous IP address usage, an unfamiliar sign-in location, and a leaked-credentials indicator found on the dark web. What does Microsoft Entra ID Protection produce by aggregating and analyzing these individual signals?

Accepted Answer

A risk level (such as low, medium, or high) that can drive automated Conditional Access responses

Answer

A compliance score reported to Microsoft Purview for data classification

Answer

A secure score recommendation for hardening tenant configuration

Answer

An eligible role assignment that requires activation through Privileged Identity Management