Microsoft 365 Administrator Expert MS-102 Practice Question

In Microsoft 365 Defender, the quickest way to stop a single compromised account from sending email is to add the account to the Restricted entities list. This action blocks the user from sending messages through Exchange Online while leaving mail flow for all other users unaffected. Other options, such as placing the mailbox on litigation hold or configuring a mail flow rule, do not immediately block outbound sending. Revoking sign-in or resetting the password helps secure the identity but does not stop mail submission until the change is enforced across services. Therefore, adding the user to the Restricted entities list is the required step.