Exam MS-102 topic 1 question 302 discussion

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-risk-based-sspr-mfa#enable-user-risk-policy-for-password-change Enable user risk policy for password change: When one of these pairs matches an account in your environment, a risk-based password change can be requested

User risk policy and in controls select allow access and require password change.

User risk policy - assesses the likelihood that a user's credentials have been compromised. If a high risk is detected (such as leaked credentials), you can configure the policy to require a password change as a mitigation action.

leaked credential falls under user risk. thus need to configure user risk policy. this ensures that if account credentials are leaked, users are prompted to change their passwords to mitigate the risk.

If the credentials are compromised, it's the user is compromised, not his session. So a user policy added to a conditional access ensure to change the user password

If the credentials are compromised, it's the user is compromised, not his session. So a user policy added to a conditional access ensure to change the user password

Tricky question here I guess... This should NOT be Password Protection since it only allows to use banned password lists to prevent user to use 'easy to guess' passwords. Users won't be able to reset their passwords themselves without SSPR but I guess this is not what we're asked. So I would say the answer should be sign-in risk policy. Please correct me if i'm wrong!! Source: https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies#microsofts-recommendation