Does Azure AD PIM Prompt Password Changes for Unknown IPs?

AZ-900 By islever Editorial Last updated

Describe Azure identity, access, and security

Short answer

B Azure AD Privileged Identity Management does not meet the goal, because only Identity Protection sign-in risk policies detect unidentified IP addresses and prompt users to change passwords.

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if
the solution satisfies the requirements.
Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet.
You have been tasked with making sure that users who connect to Azure AD via the internet from an unidentified IP address, are automatically encouraged to
change passwords.
Solution: You configure the use of Azure AD Privileged Identity Management.
Does the solution meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

The question tests whether you can distinguish PIM (just-in-time privileged role administration) from Identity Protection (risk-based sign-in detection and remediation); the trap is assuming any Azure AD security feature satisfies a risk-detection requirement.

This AZ-900 case study asks whether configuring Azure AD Privileged Identity Management (PIM) forces password changes for users signing in from unidentified IP addresses. The answer is No, because that goal belongs to Azure AD Identity Protection sign-in risk policies, not PIM.

Common mistake: Choosing A (Yes) by treating Azure AD Privileged Identity Management as a general sign-in security tool, when PIM only governs time-bound, approval-based activation of privileged roles and never detects risky sign-ins or triggers password resets.

Expert Analysis

Why the Answer Is Correct

Azure AD Privileged Identity Management is exclusively an administrative-governance service: it provides just-in-time privileged access, time-bound and approval-based role activation, and audit history for elevated roles in Azure AD and Azure resources. Nothing in PIM inspects the network origin of an ordinary sign-in, so it cannot identify an "unidentified IP address" (such as an anonymous IP) or automatically challenge the user to change a password. Detecting anonymous IP addresses, unfamiliar sign-in properties, atypical travel, and leaked credentials, then applying a "require password change" or block/register-controls response, is the job of Azure AD Identity Protection sign-in risk policies. Because the proposed solution uses the wrong service, it does not meet the goal, making B the correct verdict.

Why the Other Options Are Wrong

Option A (Yes) would require PIM to evaluate sign-in risk signals and trigger remediation, which is outside its documented function; PIM only manages eligibility and activation for privileged roles. Option A also ignores that the users described are ordinary users connecting over the internet, not privileged administrators being granted elevated roles. Conditional Access could be layered to act on Identity Protection's risk level, but Conditional Access alone is not what was configured here — PIM was. Every commenter who analyzed the service capabilities reached the same conclusion, so no option other than B survives scrutiny.

Community Comment Notes

Buiducvu cited the Identity Protection sign-in risk policy documentation and listed the exact signals it detects, including "Anonymous IP address use," which precisely matches the scenario. Kahla summarized the core distinction well: PIM "manages access to privileged roles but does not detect risky sign-ins," with Identity Protection being the appropriate service. BinuRaj's top-voted comment reinforces this by describing PIM's scope as "time-based and approval-based role activation" for mitigating excessive or misused privileged permissions — nothing about sign-in risk. Kanders and Jas001 likewise concluded No, pointing to Identity Protection, and no commenter argued that PIM could satisfy the requirement.

Official Reference

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy

This link opens the official vendor documentation in a new tab.

Exam Strategy

In scenario-based Yes/No questions, name the service's documented purpose in one phrase before judging; if the named service's purpose does not cover the stated requirement, the answer is No. Here, PIM = privileged role administration, Identity Protection = sign-in risk detection, so the mismatch is immediate.

Frequently Asked Questions

Which Azure AD service detects sign-in from an anonymous or unidentified IP address?

Azure AD Identity Protection, through its sign-in risk policy, detects signals such as anonymous IP address use, atypical travel, and leaked credentials, and can require a password change or block.

What does Azure AD Privileged Identity Management actually do?

PIM provides just-in-time, time-bound, and approval-based activation of privileged administrative roles in Azure AD and Azure, with audit records — it does not evaluate sign-in risk.

More AZ-900 FAQ →

Discussion 26 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 26

  1. BinuRaj 👍 115
    Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment
  2. p7kumbhare 👍 25
    Correct service would be Azure AD Identity Protection.
  3. buiducvu 👍 5 Answered B
    B. https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy Identity Protection detects risks of many types, including: Anonymous IP address use Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray and more...
  4. jakerson 👍 4 Answered B
    To address the goal of automatically encouraging users to change passwords when connecting to Azure AD from an unidentified IP address, you can leverage Azure AD Conditional Access policies. Azure AD Conditional Access allows you to define access control policies based on various conditions, including the user's location or network location.
  5. iwarakorn 👍 3
    Answer is No rivileged Identity Management (PIM) is a service in Azure Active Directory (Azure AD) that enables you to manage, control, and monitor access to important resources in your organization. These resources include resources in Azure AD, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.
Show 21 more comments
  1. kahla 👍 3 Answered B
    Azure AD Privileged Identity Management manages access to privileged roles but does not detect risky sign-ins or automatically prompt users to change passwords when signing in from unknown IP addresses. Azure AD Identity Protection is the appropriate solution for that goal.
  2. Kanders 👍 3
    B. No - PIM is not necessary in this scenario. The Azure Identity Protection will suffice.
  3. Zaidsdb 👍 3 Answered B
    the answer is NO it's only the AIP
  4. Kimso 👍 2
    yes the answer is right and it is B:NO bcz Azure AD Identity Protection does the job
  5. dc8201 👍 2 Answered B
    No, the solution does not meet the goal.
  6. Jas001 👍 2 Answered B
    Azure AD Identity Protection.
  7. rameshsee 👍 2
    Selected Answer: B
  8. abelk 👍 2
    Answer is: B. no
  9. Mahanad 👍 1 Answered B
    Azure AD Privileged Identity Management PIM is used to manage, control, and monitor privileged access to important resources. It does not detect unfamiliar IP addresses and automatically prompt users to change their passwords. The appropriate solution is Azure AD Identity Protection Microsoft Entra ID Protection, which detects risky sign-ins and can use risk-based policies to require password changes.
  10. AlekksMaciel 👍 1 Answered B
    O Gerenciamento de Identidade Privilegiada oferece ativação de funções baseada em tempo e aprovação para mitigar os riscos de permissões de acesso excessivas, desnecessárias ou mal usadas em recursos que você valoriza. Aqui estão algumas das principais características do Gerenciamento de Identidade Privilegiada:
  11. Echicken69 👍 1
    Answer is No Azure Information Protection (AIP) is a cloud-based solution that enables organizations to discover, classify, and protect documents and emails by applying labels to content.
  12. adu72 👍 1
    The answer is B. APIM is not used to force to change password if logged from unknow IP. It is Conditional Access that can be used to force pwd change.
  13. arjunyv2022 👍 1 Answered B
    PIM does not provide risk-based conditional policies for password changes, the solution does not meet the goal
  14. tojatin 👍 1 Answered B
    It is Entra ID portection. https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection
  15. Alonsochaves 👍 1
    Azure Identity Protection will work, not need for Azured AD privileged identity mananagement
  16. Said Ismail 👍 1 Answered B
    the solution does not meet the goal
  17. dt_go 👍 1 Answered B
    answer is azure identity protection
  18. sulina27 👍 1 Answered B
    Entra ID Protection is the answer
  19. Umesh919 👍 1 Answered B
    Azure AD identity protection
  20. RaySmith 👍 1
    Answer is: B
  21. intentando 👍 1 Answered B
    B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Resource Locks for RG Protection

S-grade

Shared Responsibility in Azure SaaS

S-grade

Accessing Azure Cloud Shell via Web Browser

S-grade

Azure VM High Availability SLA Requirements

S-grade

Practice All AZ-900 Questions

Access 90 questions with complete answers and detailed explanations.

View Full AZ-900 Practice Test →

← Back to AZ-900 Study Guide