Azure AD Authentication Methods Flashcards

An administrator wants to enable passwordless authentication for users who use Windows 10 domain-joined devices. Which authentication method should they configure?

Answer: Windows Hello for Business

Windows Hello for Business is the passwordless solution designed specifically for Windows 10/11 domain-joined and Azure AD-joined devices, replacing passwords with biometric or PIN-based authentication tied to the device.

Which Azure AD feature allows users to reset their own passwords without contacting the helpdesk?

Answer: Self-Service Password Reset (SSPR)

Self-Service Password Reset (SSPR) enables users to reset or unlock their accounts without administrator intervention, reducing helpdesk load.

What is the minimum number of authentication methods a user must register when SSPR is configured to require 2 methods?

Answer: 2

When SSPR is configured to require 2 methods, users must register at least 2 authentication methods so they can use two different methods to verify their identity during reset.

An organization wants to allow users to register both MFA and SSPR information in a single registration experience. Which Azure AD feature enables this?

Answer: Combined security information registration

Combined security information registration provides a unified registration experience where users can register their MFA and SSPR authentication methods in a single workflow at aka.ms/mysecurityinfo.

Which authentication method in Azure AD uses a physical device compliant with the FIDO Alliance standards for passwordless sign-in?

Answer: FIDO2 security keys

FIDO2 security keys are physical hardware devices (like YubiKey) that comply with FIDO2/WebAuthn standards, enabling passwordless authentication without any shared secrets.

A user reports they are no longer receiving MFA push notifications from the Microsoft Authenticator app. Which Azure AD portal should an administrator visit to re-register the user's authentication methods?

Answer: Azure AD > Users > Authentication methods

In Azure AD, administrators can view and manage a specific user's registered authentication methods by navigating to Azure AD > Users > selecting the user > Authentication methods.

Which report in Azure AD helps administrators identify users who have NOT registered for MFA?

Answer: Authentication methods activity report

The Authentication methods activity report provides registration details including which users have or have not registered specific authentication methods, making it easy to identify gaps in MFA adoption.