When configuring Conditional Access risk policies, which risk level should be assigned for sign-ins originating from IP addresses with suspicious activity?

The correct answer is Medium. Azure AD Identity Protection classifies sign-ins from IP addresses with suspicious activity as a Medium risk. This category indicates that while the activity is unusual and warrants investigation, it doesn't immediately suggest a high-confidence compromise like a sign-in from an unfamiliar location with an impossible travel scenario (which would be High risk). Low risk typically applies to less severe anomalies, such as sign-ins from infected devices that are known to be remediated. Assigning 'None' would mean no risk is detected, which is incorrect for suspicious activity.