
Explanation:
Statement
Answer
By the end of the day, Admin1 has received two email alerts.
No
By the end of the day, Admin2 has received three email alerts.
Yes
By the end of the day, Admin3 has received three email alerts.
No
Microsoft Entra ID Protection sends Users at risk detected email alerts when a user's risk level reaches the configured threshold. Here, the threshold is Medium or above , so the 1:00 PM Low risk event does not generate an alert. The 2:00 PM Medium event generates one alert, the 3:00 PM Medium event generates another because Microsoft states that later risk detections can trigger additional emails even if the recalculated risk remains at the configured level, and the 4:00 PM High event generates a third alert because it is still above the configured threshold. Microsoft also states that extra emails are suppressed only within a five- second period; these events are one hour apart, so that suppression rule does not reduce the count.
Admin1 receives the alerts because Admin1 is explicitly configured as a recipient, but the statement says two alerts; the correct count is three , so it is No. Admin2 receives three alerts because Security Reader users are automatically included by default for ID Protection notifications when they have a valid email or alternate email. Admin3 does not receive the alerts because User Administrator is not one of the automatically included roles and is not configured as a recipient.