Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

The Anonymous IP address detection is triggered when a sign-in comes from an IP address that is known to be an anonymizer, such as the Tor network or a public proxy. Because attackers often hide their true location with these services, Entra ID Protection treats such sign-ins as risky. Malicious IP address targets addresses on threat-intelligence block lists, Impossible travel compares locations and travel times between consecutive sign-ins, and Unfamiliar sign-in properties evaluates deviations from the user's normal behavior. Only the Anonymous IP address detection specifically focuses on anonymizing services.