A service that detects, investigates, and remediates identity risks, such as leaked credentials, sign-ins from anonymous IPs, or impossible travel. It calculates user risk and sign-in risk, which are used as conditions in Conditional Access.
In SC-900 the key difference is user risk (the account is likely compromised, for example due to leaked credentials) vs. sign-in risk (a specific sign-in is suspicious). It requires Entra ID P2.
Microsoft Entra ID Protection is a concept that can show up on the exam. Check the full guide to see it in context.