Prepare for SC-200 with a reference that remembers your progress.

Identity Protection analyzes user behavior and sign-in patterns to detect identity risk. The module covers risk detections, user and sign-in risk policies, MFA registration, investigation, workload identities, Defender for Identity, and the Identity Risk Management Agent.

Identity Protection automates detection/remediation, supports portal investigation, and exports risk data to SIEM and third-party tools. Full capabilities require Microsoft Entra ID Premium P2.

Security Administrator has broad Identity Protection access; Security Operator can investigate and confirm safe/compromised activity but cannot configure policies or reset passwords; Security Reader is read-only.

• Sign-in risk estimates whether a specific authentication was performed by someone other than the legitimate user.
• User risk estimates whether the account itself is compromised.

For self-remediation, users must be registered for MFA and SSPR. Microsoft recommends a user-risk threshold of High and a sign-in-risk threshold of Medium and above. Exclude emergency access accounts and review exclusions regularly.

Use the Entra admin center under Identity → Protection → Identity Protection. The lesson UI also shows block controls, but Microsoft's self-remediation recommendation is to allow access with password change for user risk and MFA for sign-in risk.

MFA registration policy ensures users register a second authentication factor before a risky event occurs. Under Identity Protection, assign users/groups, retain the fixed control Require Microsoft Entra ID multifactor authentication registration, enable the policy, and save.

Remediation options include policy-based self-remediation, password reset, confirming compromise/safety, dismissing risk, blocking sign-in, or closing individual detections. Dismissing risk closes events but does not change an exposed password, so use it only when the risk is known to be false or otherwise handled.

Workload identities represent applications, service principals, and managed identities. They cannot perform MFA, often lack lifecycle governance, and must store credentials, which increases risk.

• Risk detections include threat-intelligence matches, suspicious sign-ins, unusual OAuth credential additions, admin-confirmed compromise, and leaked credentials.
• Requires Entra ID Premium P2 and a Security Administrator, Operator, or Reader role.
• Conditional Access for workload identities can block risky single-tenant service principals; multi-tenant apps, third-party SaaS, and managed identities are outside that policy scope.

Defender for Identity uses on-premises Active Directory signals to detect compromised identities and insider threats. Sensors installed on domain controllers and AD FS observe traffic and authentication events, send parsed data to the cloud service, and surface incidents in the Defender portal.

The Security Copilot agent scans at-risk users, investigates risky sign-ins and detections, generates a risk summary and verdict, and suggests remediation such as dismissing risk or resetting a password.

• Requires Entra ID P2, Security Compute Units, and appropriate roles.
• Triggers: continuous (every five minutes), daily, or manual.
• Scope: selected users/groups, risk level, up to 100 recent risky users, and up to 90 days.
• Security Reader/Global Reader can view; Security Administrator activates and takes action.

Review risk policies, combined MFA/SSPR registration, emergency access accounts, managed identities, risk remediation, notifications, and Defender for Identity.