You have an Azure AD tenant that contains the users shown in the following table.

 User1 can sign in by using multi-factor authentication (MFA): No

 User2 can sign in by using multi-factor authentication (MFA): No

 User3 can sign in from an anonymous IP address: No

This scenario is based on Azure AD Identity Protection and its two core conditional access mechanisms:

User risk policy — evaluates the probability that a user's identity might be compromised.

Sign-in risk policy — evaluates the probability that a sign-in attempt might not be performed by the legitimate user.

Let’s analyze step-by-step based on the tables provided:

Risk level: Low

User risk policy: Applies to Low and above (so Low, Medium, and High users).

Control: Block access.

Action performed: Confirm user compromised.Confirming a user as compromised keeps or increases their risk level until the user is remediated (i.e., password reset).Because the policy blocks access for any user risk “Low and above,” User1’s sign-in is blocked, and MFA will not be prompted — access is denied.

✅ User1 MFA sign-in: No

Initial risk level: Medium

Actions performed:

Confirm sign-in safe → clears that sign-in’s risk.

Confirm user compromised → elevates user risk back to “High.”

Policies applied:

User risk policy (Low and above): Blocks access.

Sign-in risk policy: Applies only to High sign-ins (not relevant here).

Since User2’s user risk is set to High after confirming compromised, the User risk policy blocks access for “Low and above.”

Therefore, MFA is not allowed (the session is denied outright).

✅ User2 MFA sign-in: No

User risk: High

Action performed: Dismiss user risk → resets the user risk to “No risk.”

Sign-in policy: High sign-in risk → block access.If User3 signs in from an anonymous IP, Azure AD Identity Protection detects this as a High sign-in risk (per Microsoft documentation).Since the sign-in risk policy blocks all high sign-ins, access will be blocked.

✅ User3 anonymous IP sign-in: No