SC-300 Certification Practice Question #183

Question

You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure AD Identity Protection enabled.
You need to implement a sign-in risk remediation policy without blocking user access.
What should you do first?

Accepted Answer

The requirement is a *sign-in* risk remediation policy that lets users self-remediate rather than be blocked. MS Learn states MFA is the only self-remediation control for sign-in risk, and explicitly warns that users must be registered for MFA *before* the policy triggers or they are blocked — so registering/implementing MFA for all users is the correct first step. SSPR (option C) is tied to *user* risk (secure password change), not sign-in risk, which is the common trap the dissenting comment fell into. The Suggested Answer, the dominant Most Voted (12), and both Highly Voted comments all align with MS Learn, so confidence is high; held at 92% only because of the single low-vote C dissent.

More SC-300 practice questions