Exam AZ-103 topic 5 question 25 discussion

Answer is correct. In MFA service settings you can add the public IP/IPs of your corporate network with /32 CIDR and exclude from MFA verification.The trusted IP address ranges can be private or public.

The answer is D. They are asking for administrators only who will be able to access the Azure portal without entering a verification code when they are connecting from your on-premises network. Changing the multi-factor authentication service settings will affect all the users and not just the Administrators.

An Azure AD Conditional Access Policy

Given answer is correct! Just recall MFA setting panel, the first seletion is users and groups. Go from here to get the question's requiring.

Given Answer is correct! Check it out the following URL! 1) multi-factor authentication =======================(https://account.activedirectory.windowsazure.com/usermanagement/mfasettings.aspx) 2) service settings, underneath there is an option below 3) Skip multi-factor authentication for requests from federated users on my intranet that's why C is the right answer! thanks

D. an Azure AD Identity Protection sign-in risk policy

At first one would think 'Conditional Access', but the answer is actually correct. See 'Additional cloud-based MFA settings' under MFA service settings in the below URL; https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#mfa-service-settings Once 'Additional cloud-based MFA settings' is clicked it takes you to the 'multi-factor authentication' Service settings page which gives you the option to configure trusted IP location to prevent MFA prompts for said location.

Question says MFA is activated for Administrators , it never said that MFA was enabled for All users across the company. Hence entering trusted IPs on the MFA service page is enough to disable them.

I think it can be done through Multi factor auth sevice setting page in Conditional access On the multi-factor authentication service settings page, you can identify corporate intranet users by selecting Skip multi-factor authentication for requests from federated users on my intranet. This setting indicates that the inside corporate network claim, which is issued by AD FS, should be trusted and used to identify the user as being on the corporate network https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#enable-the-trusted-ips-feature-by-using-conditional-access

To all the folks that keep suggesting the answer is D: Identity Protection ... please provide a link to justify your answer. Did you try it?? Because I tried it and there is no blade where you can set a location/IP policy. However, I was able to accomplish the task via MFA. Hence the answer is B: MFA To further justify my answer, here is a link also - https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#mfa-service-settings

Trusted Ip feature can be enabled through service setting blade.

Think B is correct, Multi factor auth MFA service settings Settings for app passwords, trusted IPs, verification options, and remember multi-factor authentication for Azure Multi-Factor Authentication can be found in service settings. This is more of a legacy portal, and isn't part of the regular Azure AD portal. Service settings can be accessed from the Azure portal by browsing to Azure Active Directory > Security > MFA > Getting started > Configure > Additional cloud-based MFA settings. A new window or tab opens with additional service settings options. Trusted IPs The Trusted IPs feature of Azure Multi-Factor Authentication bypasses multi-factor authentication prompts for users who sign in from a defined IP address range. You can set trusted IP ranges for your on-premises environments to when users are in one of those locations, there's no Azure Multi-Factor Authentication prompt. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#:~:text=In%20the%20Azure%20portal%2C%20search,to%20provide%20to%20your%20users.

@ jonnybugaloo is there a link you got your answer from? could you post it in here.

The given answer is correct: Trusted IPs The Trusted IPs feature of Azure Multi-Factor Authentication is used by administrators of a managed or federated tenant. The feature bypasses two-step verification for users who sign in from the company intranet. The feature is available with the full version of Azure Multi-Factor Authentication, and not the free version for administrators. For details on how to get the full version of Azure Multi-Factor Authentication, see Azure Multi-Factor Authentication.

The given answer is correct: Trusted IPs The Trusted IPs feature of Azure Multi-Factor Authentication is used by administrators of a managed or federated tenant. The feature bypasses two-step verification for users who sign in from the company intranet. The feature is available with the full version of Azure Multi-Factor Authentication, and not the free version for administrators. For details on how to get the full version of Azure Multi-Factor Authentication, see Azure Multi-Factor Authentication.

B is correct answer. To all those suggesting D is correct; the Q states on-premise network. From sign-in risk policy, you cannot set a network scope.

D is correct