Investigate and remediate identity and cloud app risks using Microsoft Defender for Cloud Apps, Microsoft Entra ID, and Microsoft Defender for Identity.

While triaging a Microsoft Defender XDR incident, an analyst sees a Microsoft Defender for Identity alert titled Suspected identity theft (pass-the-hash) for an on-premises service account. The analyst wants to determine whether the same account also shows elevated risk in the cloud and to review its recent risky sign-ins as part of one investigation. Which signal source should the analyst consult to assess the account's cloud identity risk?

• AThe Microsoft Entra ID Protection risky users and risky sign-ins reports, which surface the account's cloud risk level and the risk detections behind its recent sign-ins for the investigation.check_circle Correct
• BThe Microsoft Defender for Identity health alerts, which report the status of the sensors and configuration so the analyst can confirm the domain controllers are sending data for the account.
• CThe Microsoft Defender for Cloud secure score recommendations, which rate the security posture of the subscription so the analyst can judge how exposed the account's cloud resources currently are.
• DThe Microsoft Defender for Cloud Apps app governance dashboard, which assesses the risk of registered OAuth applications so the analyst can see whether apps consented by the account are risky.

Why A is correct: Microsoft Entra ID Protection is the workload that computes cloud identity risk, so its risky users and risky sign-ins reports show the account's current risk level and the detections behind its recent sign-ins, which is precisely the cloud-side view the analyst needs.

Why B is wrong: Defender for Identity health alerts report on sensor and service health rather than identity risk, so while they confirm telemetry is flowing, they tell the analyst nothing about the account's cloud risk level or its risky sign-ins.

Why C is wrong: Microsoft Defender for Cloud secure score measures the security posture of cloud workloads and subscriptions, not the risk attached to a user identity, so it cannot tell the analyst whether this specific account shows elevated sign-in risk.

Why D is wrong: App governance evaluates the risk posture of OAuth applications and their API usage, which is about app risk rather than user identity risk, so it does not provide the account's cloud risk level or its risky sign-in history.