SC-100 Certification Practice Question #76

Question

You have a Microsoft Entra tenant that is linked to a Microsoft 365 subscription and an Azure subscription. The tenant contains service principals that are used to access applications in the Azure subscription.

You need to recommend a solution to detect risky sign-ins and other risky activities performed by the service principals in the tenant. The solution must minimize costs.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is to detect risky sign-ins and other risky activities performed by *service principals* (workload identities). MS Learn is explicit that Microsoft Entra ID Protection is the service that detects, investigates, and remediates workload-identity risk, and that the Risky workload identities report / Workload identity detections require **Workload Identities Premium** licensing — not P1 or P2, which cover user/sign-in risk only. Workload ID Premium is the minimum-cost license that actually unlocks workload-identity risk detection, satisfying "minimize costs." The top-voted, doc-cited comment (ruscomike) matches this exactly. Confidence is held at 87 rather than 90+ because the captured discussion lacks an official Suggested Answer/Most Voted marker and a minority argues P2 suffices (P2 does not surface the workload-identity detection report, so it is discounted).

More SC-100 practice questions