📖 What is Microsoft Entra ID Identity Protection?
Microsoft Entra ID Identity Protection is a service that helps identify, investigate, and remediate identity-based risks. It utilizes machine learning to detect anomalies, such as leaked credentials or atypical travel, to protect user accounts from unauthorized access.
"Remember that this feature requires Microsoft Entra ID P2 licenses to function; keep licensing requirements in mind for the exam."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Entra ID Identity Protection?
- ▸ User Risk assesses the probability that a specific identity is compromised, often triggered by leaked credentials discovered on the dark web or other external sources.
- ▸ Sign-in Risk evaluates the probability that a specific authentication request is unauthorized, detecting anomalies like atypical travel or logins from unfamiliar locations.
- ▸ Risk-based policies allow administrators to automate remediation, such as forcing a password reset for high user risk or requiring MFA for high sign-in risk.
- ▸ The service integrates deeply with Conditional Access, enabling granular control over access based on the real-time risk level of the user or session.
- ▸ Licensing is a critical exam point; Microsoft Entra ID P2 is required to utilize the automated risk detection and remediation policy features.
🎯 How does Microsoft Entra ID Identity Protection appear on the MS-102 Exam?
A scenario might describe a user logging in from a location they have never visited before. You will be asked to identify if this triggers a sign-in risk or a user risk.
You may be asked to design a solution that automatically requires a password change when a user's credentials appear in a known leak, requiring the selection of a User Risk policy.
Expect questions where you must determine the minimum licensing requirement to implement automated risk-based Conditional Access policies across a global organization.
❓ Frequently Asked Questions
What is the fundamental difference between User Risk and Sign-in Risk?
Sign-in risk focuses on the specific authentication attempt (e.g., an unusual IP), while user risk focuses on the overall state of the account (e.g., credentials leaked online).
Can I use Identity Protection without Conditional Access?
Yes, Identity Protection has its own standalone risk policies, but using it within Conditional Access provides more flexibility and integration with other security signals.
How does 'Atypical Travel' differ from 'Unfamiliar Sign-in Properties'?
Atypical travel detects logins from two distant locations faster than physically possible, whereas unfamiliar properties detect logins from a new device, browser, or location.