Which Azure service should you use so that Azure Active Directory (Azure AD) users who connect from the Internet using an anonymous IP address are automatically prompted to change their password?

Azure AD Identity Protection is the correct service because it detects potential vulnerabilities affecting your organization’s identities, configures automated responses to detected suspicious actions, and investigates suspicious incidents. Specifically, it can identify anonymous IP address usage and automatically prompt users for a password change or multi-factor authentication (MFA) to mitigate risk. Azure AD Connect Health monitors your on-premises identity infrastructure. Azure AD Privileged Identity Management (PIM) manages, controls, and monitors access to important resources in Azure AD, Azure, and other Microsoft Online Services. Azure Advanced Threat Protection (ATP) (now Microsoft Defender for Identity) is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. These services do not directly address the scenario of automatically prompting users to change their password based on anonymous IP address usage.