An administrator configures a Microsoft Entra ID Protection user risk policy that grants access only after the user self-remediates. The team wants the access control that both unblocks the user and lowers their accumulated user risk to a safe state automatically. Which grant control should the policy use?
- ARequire multi-factor authentication, because completing a second factor proves the identity is genuine and resets the accumulated user risk to a low level.
- BRequire the device to be marked as compliant, because a healthy Microsoft Intune device proves the account is safe and clears the standing user risk score.
- CRequire approved client app, because forcing a managed application to reauthenticate the account confirms the user is legitimate and resets the user risk.
- DRequire password change, because a secure self-service password reset remediates the compromised credential and automatically returns the user risk to a safe state. Correct
Why A is wrong: MFA addresses sign-in risk remediation; passing MFA alone does not clear accumulated user risk, so the user remains flagged as risky after authenticating.
Why B is wrong: Device compliance verifies device health, not identity remediation; it does not prompt a credential reset and therefore cannot return an elevated user risk score to safe.
Why C is wrong: Approved client app limits which applications connect and has no link to user risk remediation, so the standing user risk is never cleared by this control.
Why D is correct: A secure password change through self-service password reset is the user risk remediation control; it invalidates the suspect credential and ID Protection then lowers the user risk to safe automatically.