How Do You Force a Password Change for Leaked Credentials in Entra ID Protection?
You have a Microsoft 365 E5 subscription. You plan to use Microsoft Entra ID Protection. You need to ensure that account passwords must be changed if account credentials are leaked. What should you configure?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can separate user risk (the credentials themselves are compromised, e.g. leaked credentials) from sign-in risk (the authentication attempt or session looks risky), because only a user risk policy offers the 'Require password change' remediation.
Leaked account credentials in Microsoft Entra ID Protection are a user risk detection, and the remediation that forces a password change is configured through a user risk policy. This page explains why option A, a user risk policy, is the correct answer for MS-102 and why sign-in risk, Password protection, and SSPR do not satisfy the requirement.
The most common wrong choice is a sign-in risk policy, because learners see a risky event and assume it covers leaked credentials; sign-in risk actually covers real-time sign-in anomalies such as anonymous IPs or atypical travel, and its remediation is MFA or block, not a forced password change for compromised credentials.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft Entra ID Protection classifies leaked account credentials as a user risk detection: the identity itself is considered compromised, not merely the current session. A user risk policy evaluates that user risk level and, when high risk is detected, can apply the access control Require password change so the user must reset the password before continuing. The Microsoft Learn tutorial cited by justITtopics in the comments shows exactly this configuration, noting that when the leaked credential pair matches an account, a risk-based password change can be requested. Because the question asks specifically for leaked credentials plus a mandatory password change, the user risk policy is the only option that maps detection and remediation together.Why the Other Options Are Wrong
B. Password protection only enforces Microsoft's global banned password list and custom banned lists; it blocks weak or predictable passwords and has no visibility into leaked credential pairs, so it cannot force a change. C. a sign-in risk policy reacts to sign-in signals such as anonymized IP addresses, unfamiliar locations, or atypical travel, and its remediation is MFA or block — not password change for leaked credentials. D. self-service password reset (SSPR) lets a user reset a forgotten or expired password, but it is a reset capability, not a risk-detection policy; SSPR is an enabler that is combined with the user risk policy for password writeback, never the policy that detects the leak itself.Community Comment Notes
Several learners converge on the same reasoning: Tr619899 explains that a user risk policy "assesses the likelihood that a user's credentials have been compromised," and 0b29bdf states plainly that leaked credentials fall under user risk and require a password change. mido3100 gives the configuration detail "User risk policy and in controls select allow access and require password change," while justITtopics supplies the Microsoft Learn link on enabling a user risk policy for password change. Drainev initially leaned toward a sign-in risk policy but openly asked to be corrected, which highlights the exact trap the exam sets: leaked credentials are user risk, whereas a risky sign-in is session risk. The vote record and the source key both agree with the user risk policy here, and the official documentation supports it.Official Reference
Exam Strategy
Read the risk noun carefully: if the scenario says credentials were leaked or compromised, choose user risk; if it says the sign-in attempt looks suspicious from an unknown location or anonymous IP, choose sign-in risk. For user risk, remember the access control that satisfies a mandatory password change is 'Require password change' under a user risk policy.
Frequently Asked Questions
Why is a sign-in risk policy not the answer for leaked credentials?
Sign-in risk evaluates the authentication attempt or session, such as an anonymous IP or atypical travel, not compromised stored credentials. Leaked credentials are user risk, and only a user risk policy applies the 'Require password change' remediation.
Does Password protection or SSPR satisfy the leaked-credential requirement?
No. Password protection only blocks weak or banned passwords, and SSPR merely lets users reset their own password. Neither detects leaked credentials or forces a password change based on risk.
Related Analysis
Practice All MS-102 Questions
Access 111 questions with complete answers and detailed explanations.
View Full MS-102 Practice Test →