According to the Microsoft Identity and Access Administrator (SC-300) Official Study Guide and Microsoft Learn: "Azure AD Identity Protection - User Risk Policies and Remediation", Azure AD Identity Protection provides mechanisms to automatically or manually remediate risky user accounts based on detected user risk levels (low, medium, high).
The scenario states:
* A User risk policy (Risk1) exists that requires users with a high severity risk to reset their password upon next sign-in.
* User1 has triggered a medium severity alert, not high.
* The goal is to force User1 to reset his password on the next sign-in, with minimal administrative effort.
* A. Configure a sign-in risk policy:This policy targets sign-in risks (suspicious sign-ins), not user risks, and would not directly force a password reset - it only enforces MFA or blocks access.
* B. Mark User1 as compromised: #When an administrator marks a user as compromised in Azure AD Identity Protection, it immediately elevates the user's risk level to "high."Since the existing User risk policy (Risk1) automatically forces password reset for high-risk users, User1 will be required to change his password the next time he signs in - satisfying the requirement automatically.This approach uses the existing configuration, meeting the "minimize administrative effort" criterion.
* C. Reconfigure the user risk policy to trigger on medium or low severity:This would affect all users globally, not just User1, which is not minimal effort and could increase false positives.
* D. Reset the Azure MFA registration for User1:This affects MFA credentials, not password resets, and doesn't remediate risk.
From Microsoft's documentation:
"Marking a user as compromised increases their risk level to High, triggering any configured user risk policy to require password reset upon next sign-in." Therefore, the most efficient and compliant action according to Microsoft's SC-300 study materials is to mark User1 as compromised.