Blocking Accounts via Microsoft Entra ID Protection
Short answer
B Microsoft Entra ID Protection detects risky sign-ins and can automatically block user accounts or require step-up authentication via conditional access policies.
Question
Key Takeaways
The question tests the specific capability of identity risk-based policies in Entra ID Protection to perform automated remediation actions like account blocking.
Learn how to use Microsoft Entra ID Protection to automatically block user accounts when risky sign-ins are detected, distinguishing it from other Microsoft security services.
Common mistake: Choosing Microsoft Defender for Identity is a common error because it also deals with compromised identities; however, it primarily monitors on-premises AD activity rather than handling cloud sign-in risk policies and automatic blocking.
Expert Analysis
Identity Risk Detection vs. Threat Intelligence
The question asks for a service that automatically blocks user accounts upon detection of a risky sign-in. This specific capability is the core function of Microsoft Entra ID Protection (formerly Azure AD Identity Protection). It continuously analyzes sign-in events for anomalies such as impossible travel, anonymous IP addresses, or leaked credentials. When a high-risk sign-in is detected, it can trigger automated response actions, including blocking the user account or forcing a password change.
Why Other Options Are Incorrect
- Microsoft Defender for Identity (Option A) focuses on detecting compromised identities within an on-premises Active Directory environment by monitoring directory traffic and lateral movement. While it alerts on compromises, it does not natively handle cloud sign-in risk policies or automatic account blocking in the same integrated manner as Entra ID Protection.
- Microsoft Defender for Office 365 (Option C) is designed to protect against phishing, malware, and safe attachments in email and collaboration tools. It does not manage identity risk or sign-in security.
- Microsoft Entra Privileged Identity Management (PIM) (Option D) manages just-in-time access and approval workflows for privileged roles. It is not used for general user sign-in risk mitigation.
Key Distinction
The boundary here lies between general threat intelligence (Defender for Identity/Office 365) and identity-specific risk remediation (Entra ID Protection). As noted in community feedback, Entra ID Protection allows configuration of risk-based policies that directly intervene during the authentication flow.
Exam Strategy
When encountering questions about 'risk' and 'sign-in', immediately associate them with Microsoft Entra ID Protection. Differentiate this from Defender for Office 365 (email threats) and Defender for Identity (on-prem AD monitoring). Remember that ID Protection integrates with Conditional Access to enforce automated responses like blocking or MFA challenges.
Frequently Asked Questions
Can Microsoft Entra ID Protection automatically block users?
What is the difference between ID Protection and Defender for Identity?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
michou1524 👍 5 Answered BMicrosoft Entra ID Protection is the tool specifically designed to detect, investigate, and remediate identity-based risks. It allows you to configure risk policies (such as sign-in risk) that can take automatic actions, such as requiring a password change or directly blocking access when suspicious or risky behavior is detected.
-
hierro 👍 3 Answered BMicrosoft Entra ID Protection es la herramienta diseñada específicamente para detectar, investigar y remediar riesgos basados en la identidad. Permite configurar políticas de riesgo (como el riesgo de inicio de sesión) que pueden tomar acciones automáticas, como requerir un cambio de contraseña o bloquear el acceso directamente cuando se detecta un comportamiento sospechoso o arriesgado.
-
DieFear 👍 1 Answered BThis is the right question because you can use it to create conditional access policies to block the access the moment it is detected
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.