Does Azure AD Identity Protection Force Password Change for Anonymous IPs?

Describe Azure identity, access, and security

Answer Correct answer: A — Azure AD Identity Protection detects sign-ins from an unidentified IP address and applies a risk-based policy requiring a password change.

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet. You have been tasked with making sure that users who connect to Azure AD via the internet from an unidentified IP address, are automatically encouraged to change passwords. Solution: You configure the use of Azure AD Identity Protection. Does the solution meet the goal?

Yes Correct Answer
No

Community Insight

This question tests whether Identity Protection's risk-based password-change policies cover anonymous IP sign-ins; the trap is assuming Conditional Access alone is the required tool, when Identity Protection supplies the risk detection and hosts Conditional Access as part of its policy engine.

Azure AD Identity Protection detects risky sign-ins, including anonymous IP address use, and can apply risk-based policies that require users to change their password. The configured solution therefore satisfies the requirement that users connecting from an unidentified IP address are prompted to change passwords.

Selecting B (No), because learners look only for a Conditional Access policy and overlook that Identity Protection natively detects anonymous IP address use and enforces password change through its user risk policy.

Community Discussion (45 comments)

Said Ismail 👍 1 Selected: A

Azure AD Identity Protection detects risky sign-ins, including those from unfamiliar or anonymous IP addresses. It can automatically trigger remediation actions, such as requiring a password change, when a sign-in is classified as risky.

AlekksMaciel 👍 1 Selected: U

Detecção e remediação de riscos A Proteção de Identidade identifica riscos de vários tipos, incluindo: Uso de endereço IP anônimo Viagens atípicas Endereço IP vinculado a malware Propriedades de entrada desconhecidas Credenciais vazadas Spray de senha

Adrin07 👍 2 Selected: A

c13bee8 👍 2 Selected: A

Azure ID Protection, now called Entra ID Protection works in unison but also independently of Conditional Access, it all depends on if Conditional Access is enabled and the policies set therein. The risk detected in Entra ID Protection will be evaluated with the policy set for Conditional Access and that policy will take effect. In this case, prompting users to change their passwords.

kahla 👍 2 Selected: A

Azure AD Identity Protection can identify risky sign-ins such as those from unfamiliar IP addresses and can enforce policies that require users to change their passwords, meeting the requirement to automatically prompt password changes for such scenarios.

tojatin 👍 1 Selected: A

Microsoft Entra ID Protection helps organizations detect, investigate, and remediate identity-based risks. https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection

arjunyv2022 👍 2 Selected: A

Azure AD Identity Protection can automatically encourage users to change passwords when logging in from an unidentified IP, this solution meets the goal.

asd90 👍 2 Selected: A

Yes, the solution meets the goal. Azure AD Identity Protection provides the necessary tools and policies to detect and respond to suspicious activities, such as sign-ins from unidentified IP addresses. By configuring Azure AD Identity Protection, you can set up risk-based policies that prompt users to change their passwords when a sign-in is detected from an unfamiliar or risky IP address.

Jas001 👍 1 Selected: A

Azure AD Identity Protection to detect and respond to unexpected user behaviour in Azure Active Directory.

sulina27 👍 4 Selected: B

answer is "Entra ID Protection" Please read https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection#detect-risks NOTE: Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID to communicate the multicloud, multiplatform functionality of the products, alleviate confusion with Windows Server Active Directory, and unify the Microsoft Entra product family. Microsoft Entra ID is the new name for Azure AD. The names Azure Active Directory, Azure AD, and AAD are replaced with Microsoft Entra ID. https://learn.microsoft.com/en-us/entra/fundamentals/new-name

zswap 👍 1

One might think that Conditional Access can also be right choice. Because you can create a Conditional Access policy that triggers a password change requirement based on the risk level of the sign-in attempt. In this specific scenario, Azure AD Identity Protection is highly relevant because it is designed to automatically detect and respond to risky sign-ins, which aligns directly with the requirement.

okayhey 👍 14

Azure AD is now Entra ID

intentando 👍 2 Selected: A

AntonioTech 👍 14

A. Yes Azure AD Identity Protection is a comprehensive solution that helps you protect your organization's identities and detect and respond to potential identity-related risks. One of its features is the ability to configure risk-based policies. In this case, you can set up a risk-based policy that triggers a password change prompt for users when they connect to Azure AD via the internet from an unidentified IP address. This helps enhance security by encouraging users to change their passwords in case of suspicious activity. So, the solution of configuring Azure AD Identity Protection meets the goal of encouraging users to change passwords under specific risk conditions.

jana90 👍 2

Yes, Correct answer is Azure AD Identity Protection. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/

Zaidsdb 👍 4 Selected: A

yes, this the type of the protection

RDIO 👍 5

Azure AD Identity Protection is a range of possible measures that you can take to protect your system based on some "conditions" that you can configure Conditional Access is part of Azure AD Identity Protection. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

emptyH 👍 3

Yes as Identity Protection is a sub setting of Conditional access. I originally wanted to say NO but after viewing the linked article it is clear that A:YES is the correct answer here.

Kanders 👍 1

A. Yes - Azure AD Identity Protection is the best solution because it can detect and identify risk, where Conditional Access controls access to Azure AD applications.

buiducvu 👍 2 Selected: A

https://docs.microsoft.com/zh-tw/azure/active-directory/identity-protection/concept-identity-protection-policies

LukeSWR 👍 3

I think the correct answer is "B". "Conditional Access" grant ("Require Password Change") is the correct solution for me. Cfr. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant

Yuraq 👍 1 Selected: A

Identity Protection detects risks of many types, including: Anonymous IP address use The risk signals can trigger remediation efforts such as requiring: perform multifactor authentication, reset their password using self-service password reset, or block access until an administrator takes action. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

fenex 👍 6

Why would you encourage to change password in this scenario?

tyhtyhtyh 👍 2

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies "Require a secure password change when user risk level is High. Azure AD MFA is required before the user can create a new password with password writeback to remediate their risk." Only the genuine user will have access to their MFA in order to perform a secure password change.

Healthy_Harold 👍 1

I think to lock the genuine user out so that when they try to log in they are alerted that a bad actor has compromised their account? The strategy would only work well if end user is aware of this otherwise they would think they just forgot it. Peace & Love Harold.

sharmaurs 👍 1

nice answer. Thanks

Monster5566 👍 1

Azure Active Directory Identity Protection https://docs.microsoft.com/zh-tw/azure/active-directory/identity-protection/concept-identity-protection-policies

rameshsee 👍 3

Selected Answer: A

mrgilbe1 👍 172

If you were going thru the MS online learning like me - it talks about Conditional Access but not Identity Protection. Good to know that Conditional Access is a subset of, or a sister tool to Identity Protection.

nilsindri2007 👍 1

I also though about conditional access but not IP.

Colinilop 👍 10

I was confused as hell, thank you sir

blobstorage 👍 32

Same happened to me, just realized Identity Protection existed.

wei1020 👍 2

Ans: A Identity Protection identifies risks of many types, including: Anonymous IP address use Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray and more...

camsh015 👍 1

What Windows Defender Identity?

ti_tiago92 👍 2

Galera, estou estuando para passa na prova. Essa é a resposta A

DavidMesman 👍 1

I expected Conditional Access? Wouldn't this also work?

Adediwura 👍 5

Conditional Access falls under Identity Protection.

SyedAadRazaDevops 👍 4

Identity Protection uses the learnings Microsoft has acquired from their position in organizations with Azure AD, the consumer space with Microsoft Accounts, and in gaming with Xbox to protect your users. Microsoft analyses 6.5 trillion signals per day to identify and protect customers from threats.

Dinesh_W 👍 86

Risk detection and remediation Identity Protection identifies risks of many types, including: Anonymous IP address use Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray

antuansoft 👍 2

The correct azure documentation: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

RaySmith 👍 1

Answer is: A

Turak64 👍 12

Why would it be ID protection and not conditional access policy?

MGegruis 👍 24

Conditional access is under ID Protection

BinuRaj 👍 2

Answer correct.

Mahanad 👍 1 Selected: A

Azure AD Identity Protection now Microsoft Entra ID Protection can detect risky sign-ins, including sign-ins from unfamiliar or anonymous IP addresses. By configuring a sign-in risk policy to require a password change for high-risk sign-ins, users can be prompted to change their passwords automatically.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Azure AD Identity Protection classifies sign-in from an anonymous or unidentified IP address as a detected risk, alongside atypical travel, leaked credentials, and password spray. Its user risk policy can be configured to require a password change when risk is detected, so the described solution does satisfy the requirement. As Dinesh_W listed, "Anonymous IP address use" is explicitly one of the risk types Identity Protection identifies. AntonioTech likewise concluded "A. Yes", noting a risk-based policy triggers a password change prompt in this case.

Why the Other Options Are Wrong

Option B is wrong because it assumes Identity Protection cannot influence password behavior, yet requiring a password change is exactly the remediation its user risk policy applies. Learners who answer No tend to believe only a standalone Conditional Access policy could meet the goal; however, as RDIO explained, "Conditional Access is part of Azure AD Identity Protection," so the risk detection and enforcement both exist in the configured solution. Since the question asks only whether the solution meets the goal, not which single tool is the most narrow, Identity Protection configuration is sufficient.

Community Comment Notes

mrgilbe1 pointed out the Microsoft learning path emphasizes Conditional Access and that it is "a subset of, or a sister tool to Identity Protection," which explains the confusion. MGegruis similarly observed that "Conditional access is under ID protection," while Turak64 asked "Why would it be ID protection and not conditional access policy?" — the answer being that Identity Protection supplies the anonymous-IP risk signal that a plain policy would lack. okayhey also noted the naming change that "Azure AD is now Entra ID," which matters for matching current documentation.

Official Reference

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

Exam Strategy

When a scenario names a specific Azure service, verify whether that service natively detects the condition described rather than hunting for a different tool; Identity Protection risk detections map directly to remediation actions like forced password change. On Yes/No items, ask only whether the stated configuration can satisfy the stated requirement, not whether it is the only possible approach.

Frequently Asked Questions

Why does Identity Protection apply here instead of a Conditional Access policy?

Identity Protection supplies the anonymous IP risk detection and its user risk policy, while Conditional Access is part of Identity Protection's policy enforcement layer.

Which risk types does Azure AD Identity Protection detect?

It detects anonymous IP address use, atypical travel, malware-linked IP, unfamiliar sign-in properties, leaked credentials, and password spray attacks.

More AZ-900 FAQ →

Related Analysis

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide