Does Azure AD Identity Protection Force Password Change for Anonymous IPs?

AZ-900 By islever Editorial Last updated

Describe Azure identity, access, and security

Short answer

A Azure AD Identity Protection detects sign-ins from an unidentified IP address and applies a risk-based policy requiring a password change.

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if
the solution satisfies the requirements.
Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet.
You have been tasked with making sure that users who connect to Azure AD via the internet from an unidentified IP address, are automatically encouraged to
change passwords.
Solution: You configure the use of Azure AD Identity Protection.
Does the solution meet the goal?
  1. Yes Correct Answer
  2. No

Key Takeaways

This question tests whether Identity Protection's risk-based password-change policies cover anonymous IP sign-ins; the trap is assuming Conditional Access alone is the required tool, when Identity Protection supplies the risk detection and hosts Conditional Access as part of its policy engine.

Azure AD Identity Protection detects risky sign-ins, including anonymous IP address use, and can apply risk-based policies that require users to change their password. The configured solution therefore satisfies the requirement that users connecting from an unidentified IP address are prompted to change passwords.

Common mistake: Selecting B (No), because learners look only for a Conditional Access policy and overlook that Identity Protection natively detects anonymous IP address use and enforces password change through its user risk policy.

Expert Analysis

Why the Answer Is Correct

Azure AD Identity Protection classifies sign-in from an anonymous or unidentified IP address as a detected risk, alongside atypical travel, leaked credentials, and password spray. Its user risk policy can be configured to require a password change when risk is detected, so the described solution does satisfy the requirement. As Dinesh_W listed, "Anonymous IP address use" is explicitly one of the risk types Identity Protection identifies. AntonioTech likewise concluded "A. Yes", noting a risk-based policy triggers a password change prompt in this case.

Why the Other Options Are Wrong

Option B is wrong because it assumes Identity Protection cannot influence password behavior, yet requiring a password change is exactly the remediation its user risk policy applies. Learners who answer No tend to believe only a standalone Conditional Access policy could meet the goal; however, as RDIO explained, "Conditional Access is part of Azure AD Identity Protection," so the risk detection and enforcement both exist in the configured solution. Since the question asks only whether the solution meets the goal, not which single tool is the most narrow, Identity Protection configuration is sufficient.

Community Comment Notes

mrgilbe1 pointed out the Microsoft learning path emphasizes Conditional Access and that it is "a subset of, or a sister tool to Identity Protection," which explains the confusion. MGegruis similarly observed that "Conditional access is under ID protection," while Turak64 asked "Why would it be ID protection and not conditional access policy?" — the answer being that Identity Protection supplies the anonymous-IP risk signal that a plain policy would lack. okayhey also noted the naming change that "Azure AD is now Entra ID," which matters for matching current documentation.

Official Reference

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a scenario names a specific Azure service, verify whether that service natively detects the condition described rather than hunting for a different tool; Identity Protection risk detections map directly to remediation actions like forced password change. On Yes/No items, ask only whether the stated configuration can satisfy the stated requirement, not whether it is the only possible approach.

Frequently Asked Questions

Why does Identity Protection apply here instead of a Conditional Access policy?

Identity Protection supplies the anonymous IP risk detection and its user risk policy, while Conditional Access is part of Identity Protection's policy enforcement layer.

Which risk types does Azure AD Identity Protection detect?

It detects anonymous IP address use, atypical travel, malware-linked IP, unfamiliar sign-in properties, leaked credentials, and password spray attacks.

More AZ-900 FAQ →

Discussion 44 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 44

  1. mrgilbe1 👍 172
    If you were going thru the MS online learning like me - it talks about Conditional Access but not Identity Protection. Good to know that Conditional Access is a subset of, or a sister tool to Identity Protection.
  2. Dinesh_W 👍 86
    Risk detection and remediation Identity Protection identifies risks of many types, including: Anonymous IP address use Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray
  3. blobstorage 👍 32
    Same happened to me, just realized Identity Protection existed.
  4. MGegruis 👍 24
    Conditional access is under ID Protection
  5. AntonioTech 👍 14
    A. Yes Azure AD Identity Protection is a comprehensive solution that helps you protect your organization's identities and detect and respond to potential identity-related risks. One of its features is the ability to configure risk-based policies. In this case, you can set up a risk-based policy that triggers a password change prompt for users when they connect to Azure AD via the internet from an unidentified IP address. This helps enhance security by encouraging users to change their passwords in case of suspicious activity. So, the solution of configuring Azure AD Identity Protection meets the goal of encouraging users to change passwords under specific risk conditions.
Show 25 more comments
  1. okayhey 👍 14
    Azure AD is now Entra ID
  2. Turak64 👍 12
    Why would it be ID protection and not conditional access policy?
  3. Colinilop 👍 10
    I was confused as hell, thank you sir
  4. fenex 👍 6
    Why would you encourage to change password in this scenario?
  5. RDIO 👍 5
    Azure AD Identity Protection is a range of possible measures that you can take to protect your system based on some "conditions" that you can configure Conditional Access is part of Azure AD Identity Protection. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies
  6. Adediwura 👍 5
    Conditional Access falls under Identity Protection.
  7. sulina27 👍 4 Answered B
    answer is "Entra ID Protection" Please read https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection#detect-risks NOTE: Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID to communicate the multicloud, multiplatform functionality of the products, alleviate confusion with Windows Server Active Directory, and unify the Microsoft Entra product family. Microsoft Entra ID is the new name for Azure AD. The names Azure Active Directory, Azure AD, and AAD are replaced with Microsoft Entra ID. https://learn.microsoft.com/en-us/entra/fundamentals/new-name
  8. SyedAadRazaDevops 👍 4
    Identity Protection uses the learnings Microsoft has acquired from their position in organizations with Azure AD, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users. Microsoft analyses 6.5 trillion signals per day to identify and protect customers from threats.
  9. Zaidsdb 👍 4 Answered A
    yes, this the type of the protection
  10. LukeSWR 👍 3
    I think the correct answer is "B". "Conditional Access" grant ("Require Password Change") is the correct solution for me. Cfr. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant
  11. emptyH 👍 3
    Yes as Identity Protection is a sub setting of Conditional access. I originally wanted to say NO but after viewing the linked article it is clear that A:YES is the correct answer here.
  12. rameshsee 👍 3
    Selected Answer: A
  13. tyhtyhtyh 👍 2
    https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies "Require a secure password change when user risk level is High. Azure AD MFA is required before the user can create a new password with password writeback to remediate their risk." Only the genuine user will have access to their MFA in order to perform a secure password change.
  14. asd90 👍 2 Answered A
    Yes, the solution meets the goal. Azure AD Identity Protection provides the necessary tools and policies to detect and respond to suspicious activities, such as sign-ins from unidentified IP addresses. By configuring Azure AD Identity Protection, you can set up risk-based policies that prompt users to change their passwords when a sign-in is detected from an unfamiliar or risky IP address.
  15. c13bee8 👍 2 Answered A
    Azure ID Protection, now called Entra ID Protection works in unison but also independently of Conditional Access, it all depends on if Conditional Access is enabled and the policies set therein. The risk detected in Entra ID Protection will be evaluated with the policy set for Conditional Access and that policy will take effect. In this case, prompting users to change their passwords.
  16. kahla 👍 2 Answered A
    Azure AD Identity Protection can identify risky sign-ins such as those from unfamiliar IP addresses and can enforce policies that require users to change their passwords, meeting the requirement to automatically prompt password changes for such scenarios.
  17. wei1020 👍 2
    Ans: A Identity Protection identifies risks of many types, including: Anonymous IP address use Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray and more...
  18. arjunyv2022 👍 2 Answered A
    Azure AD Identity Protection can automatically encourage users to change passwords when logging in from an unidentified IP, this solution meets the goal.
  19. antuansoft 👍 2
    The correct azure documentation: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
  20. jana90 👍 2
    Yes, Correct answer is Azure AD Identity Protection. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/
  21. buiducvu 👍 2 Answered A
    https://docs.microsoft.com/zh-tw/azure/active-directory/identity-protection/concept-identity-protection-policies
  22. ti_tiago92 👍 2
    Galera, estou estuando para passa na prova. Essa é a resposta A
  23. BinuRaj 👍 2
    Answer correct.
  24. intentando 👍 2 Answered A
    A
  25. zswap 👍 1
    One might think that Conditional Access can also be right choice. Because you can create a Conditional Access policy that triggers a password change requirement based on the risk level of the sign-in attempt. In this specific scenario, Azure AD Identity Protection is highly relevant because it is designed to automatically detect and respond to risky sign-ins, which aligns directly with the requirement.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Resource Locks for RG Protection

S-grade

Shared Responsibility in Azure SaaS

S-grade

Accessing Azure Cloud Shell via Web Browser

S-grade

Azure VM High Availability SLA Requirements

S-grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide