Correct Answer: Create a Conditional Access policy requiring the Authentication strength 'Phishing-resistant MFA' for users in the Global Administrator role
Conditional Access policies with Authentication Strength allow you to require specific MFA methods (e.g., FIDO2, Windows Hello for Business — both phishing-resistant) for specific ...
Correct Answer
Create a Conditional Access policy requiring the Authentication strength 'Phishing-resistant MFA' for users in the Global Administrator role
Why This Answer Is Correct
Conditional Access policies with Authentication Strength allow you to require specific MFA methods (e.g., FIDO2, Windows Hello for Business — both phishing-resistant) for specific role conditions. This applies automatically to all users assigned the Global Administrator role, including future assignments. Security Defaults enable MFA but do not restrict to phishing-resistant methods only.
This question evaluates your knowledge of Azure Active Directory — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding Azure Active Directory is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
A user in your Azure AD tenant is reporting they can sign in successfully but cannot access a specific Azure resource even though they are a member of a group that has the Contributor role on that resource. What should you investigate first?
You need to allow an external vendor to access a specific Azure storage account for 30 days. The vendor uses a different Azure AD tenant. You want to avoid creating guest accounts and leverage their existing corporate identity. Which solution should you use?
Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?
Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?