Exam AZ-300 All Questions

View all questions & answers for the AZ-300 exam

Exam AZ-300 topic 4 question 17 discussion

Actual exam question from Microsoft's AZ-300

Question #: 17
Topic #: 4

You have an Azure solution that uses Multi-Factor Authentication for added security when users are outside of the office. The usage model has been set to Per
Authentication.
Your company acquires another company and adds the new staff to Azure Active Directory (Azure AD). New staff members must use Multi-Factor Authentication.
You need to change the usage model to Per Enabled User.
What should you recommend?

A. Create a new Multi-Factor Authentication provider and reconfigure the usage model.
B. Create a new Multi-Factor Authentication provider with a backup from the current Multi-Factor Authentication provider data.
C. Use the Azure portal to change the current usage model.
D. Use Azure CLI to change the current usage model.

Show Suggested Answer

Suggested Answer: B 🗳️
Since it is not possible to change the usage model of an existing provider as it is right now, you have to create a new one and reactivate your existing server with activation credentials from the new provider.
References:
https://365lab.net/2015/04/11/switch-usage-model-in-azure-multi-factor-authentication-server/

by RazorCrest at Feb. 7, 2020, 1:19 a.m.

Comments

Submit Cancel

RazorCrest

Highly Voted 5 years, 4 months ago

A and B are not an option because you can no longer create MFA Provider

upvoted 11 times

...

Famous_Guy

Highly Voted 5 years, 1 month ago

Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses.

upvoted 8 times

praveen97

4 years, 10 months ago

Question is not valid anymore. You cannot change the usage model (per enabled user or per authentication) after an MFA provider is created. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider#manage-your-mfa-provider

upvoted 4 times

...

colinquek

4 years, 9 months ago

Should it be "Use the Azure portal to change the current usage model. " then?

upvoted 1 times

...

us3r

Most Recent 4 years ago

q not valid anymore. If you had to choose between the answers, I guess "C" would be correct.

upvoted 1 times

...

MMohammad

4 years, 8 months ago

The answer should be: C. Use the Azure portal to change the current usage model. Explanation When we use Multi-Factor Authentication on a Per Authentication basis, that means we are using Conditional Access policies. To change it to a Per user basis , we have to disabled Conditional Access Policies and enable MFA on a user by user basis.

upvoted 1 times

...

MIRo2k

4 years, 11 months ago

I think C .... https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates If MFA is re-enabled on a user object that already has registration details, such as phone or email, then administrators need to have that user re-register MFA via Azure portal or PowerShell. If the user doesn't re-register, their MFA state doesn't transition from Enabled to Enforced in MFA management UI.

upvoted 4 times

...

milind8451

5 years, 1 month ago

This ques invalid as per current changes in Azure.

upvoted 4 times

...

tmurfet

5 years, 2 months ago

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates indicates that this can be done using Portal or PowerShell -- don't see Azure CLI mentioned.

upvoted 2 times

tmurfet

5 years, 2 months ago

Correction, you have to first delete the existing MFA provider -- so this question is no longer valid at all -- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider

upvoted 3 times

...