Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Microsoft Entra ID Protection includes risk policies that continuously evaluate sign-in and user behavior. A user risk policy can automatically block access or force a password reset when the calculated user risk is high, directly addressing the requirement to detect compromised credentials and require a password change. Privileged Identity Management focuses on just-in-time elevation of privileged roles, not risk-based password resets. Access reviews help verify continued access appropriateness but do not enforce real-time password changes based on risk. Conditional Access enforces access decisions based on conditions such as location or device compliance, yet it relies on signals (including risk) surfaced by ID Protection; it does not itself calculate user risk or mandate password resets. Therefore, configuring Microsoft Entra ID Protection risk policies is the correct choice.