SC-300 Certification Practice Question #109

Question

You create a new Microsoft 365 E5 tenant.

You need to ensure that when users connect to the Microsoft 365 portal from an anonymous IP address, they are prompted to use multi-factor authentication (MFA).

What should you configure?

Accepted Answer

"Anonymous IP address" is classified by Microsoft Entra ID Protection as a **sign-in risk** detection, and a sign-in risk policy is the control that evaluates that risk in real time and requires MFA when the configured risk level is met. User risk (B) responds to signals that an account is compromised (leaked credentials, etc.) and typically forces a secure password change, not an MFA prompt for a single risky sign-in. MFA registration policy (C) only ensures users enroll in MFA — a prerequisite — but does not itself prompt for MFA based on the sign-in's risk. The Suggested Answer, the Most Voted, the top community comment, and MS Learn all converge on A.

More SC-300 practice questions