4.6 Microsoft Entra ID Protection and Risk
Key Takeaways
- Microsoft Entra ID Protection is the Entra capability area for identity risk scenarios.
- Risk language in a question often points to suspicious sign-in or identity compromise concerns.
- Identity Protection is distinct from Defender for Identity, which protects on-premises Active Directory.
- Risk-based identity scenarios still rely on the same authentication, access, and governance concepts.
Identity Protection focuses on risk
Microsoft Entra ID Protection is the Entra topic associated with identity risk. The exam objective names Identity Protection alongside Conditional Access, roles, governance, access reviews, and PIM. At SC-900 depth, the important idea is that risk signals can affect identity security decisions. If a sign-in or identity looks risky, the organization needs a way to detect that concern and respond with identity-centered controls.
- Identity Protection belongs to Microsoft Entra.
- It is associated with identity risk.
- Risk scenarios often involve suspicious sign-in or compromise concerns.
- It complements, rather than replaces, authentication and access controls.
Product boundary matters
The name can sound similar to other Defender products, so keep the boundary clear. Microsoft Entra ID Protection is an identity risk capability in the Entra area. Defender for Identity is a Defender product that protects on-premises Active Directory. Microsoft Sentinel is for SIEM and SOAR. Microsoft Purview is for compliance and data governance. The question wording should tell you whether the risk is an identity access problem or a broader security operations problem.
| Scenario clue | Best product area |
|---|---|
| Risky identity or sign-in | Microsoft Entra ID Protection |
| On-premises Active Directory protection | Defender for Identity |
| SIEM incident and automation | Microsoft Sentinel |
| Compliance, labels, or retention | Microsoft Purview |
Risk-based access reasoning
Risk does not erase the rest of the identity model. A risky sign-in still involves an identity, an authentication method, and an access decision. Identity Protection adds the risk context that can influence how the organization responds. In a scenario, look for language about detected risk, suspicious identity behavior, or possible compromise. Then decide whether the answer should identify risk, require stronger proof, restrict access, or govern privileges.
- Risk detected: Identity Protection clue.
- Stronger proof required: MFA or Conditional Access control.
- Administrative elevation: PIM clue.
- Continued access validation: access review clue.
Final Entra decision map
The Microsoft Entra portion of SC-900 covers a connected identity story. Entra ID stores and manages identities. Authentication methods and MFA help prove identities. Conditional Access evaluates context and applies controls. Roles and RBAC grant permissions. Governance, access reviews, and PIM keep access appropriate over time. Identity Protection adds risk awareness to identity decisions. Use this map to avoid treating every Entra question as the same feature.
- Identity object problem: Entra ID basics.
- Sign-in proof problem: authentication and MFA.
- Contextual access problem: Conditional Access.
- Ongoing access or privilege problem: governance, access reviews, or PIM.
- Risk wording: Identity Protection.
Exam anchor
Risk wording should make you pause before choosing a generic access tool. If the risk is specifically about identity or sign-in behavior, Identity Protection is the Entra capability to consider. If the wording shifts to investigation, incidents, and automation, the scenario may have moved into Microsoft Sentinel instead.
- Identity risk: Entra ID Protection.
- Stronger sign-in proof: MFA.
- Context-based enforcement: Conditional Access.
- Security operations: Microsoft Sentinel.
Which Microsoft Entra capability area is most directly associated with identity risk?
Which product boundary is correct for SC-900 product matching?
A question mentions suspicious sign-in risk and asks for the Entra capability that helps address identity risk. What should you choose?