An organisation runs several service principals for unattended automation and wants Microsoft Entra ID Protection to block any workload identity automatically when its risk becomes high, then have a named team remediate it. Before this can be enforced, which licensing and policy prerequisite must be in place for the workload identity risk control to function?
- AMicrosoft Entra ID P2 user licensing must be assigned to each service principal, and a sign-in risk policy must be scoped to those service principals at the high risk level.
- BMicrosoft Entra ID Governance licensing must be assigned, and an access review of the service principals must be scheduled to block any that reach the high risk level.
- CMicrosoft Entra Workload ID Premium licensing must be assigned, and a standalone workload identity risk policy in Microsoft Entra ID Protection must block the affected service principals at the high risk level.
- DMicrosoft Entra Workload ID Premium licensing must be assigned, and a Conditional Access policy scoped to workload identities with the service principal risk condition must block them at the high risk level. Correct
Why A is wrong: Tempting because P2 covers user risk policies, but workload identities are not licensed by user P2 and sign-in risk policies target users, not service principals.
Why B is wrong: Tempting because governance manages identities, but access reviews recertify access and do not auto-block on risk, and Governance is the wrong add-on for workload identity risk.
Why C is wrong: Tempting because the licence is right, but there is no standalone workload identity risk policy separate from Conditional Access; risky workload identities are blocked by a Conditional Access policy scoped to workload identities.
Why D is correct: Risk-based blocking of workload identities is enforced through a Conditional Access policy scoped to workload identities using the service principal risk condition, and that capability requires the Workload ID Premium add-on.