Exam MS-500 topic 4 question 33 discussion

To review and understand Azure AD Multi-Factor Authentication events, you can use the Azure Active Directory (Azure AD) sign-ins report. This report shows authentication details for events when a user is prompted for multi-factor authentication, and if any Conditional Access policies were in use. For detailed information on the sign-ins report

D is correct!

You can use the Azure Active Directory (Azure AD) sign-ins report that shows authentication details for events when a user is prompted for MFA, and if any Conditional Access policies were in use.

I would say D as correct answer here, because I don't believe the answer C is up-to-date or isn't complete. I mean.... currently (3/21) you don't need to donwload the csv. Just go to: AAD blade -> Security (missing in the C answer) -> Authentication methods -> Registration and reset events (not activities like C answer) https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-methods-activity#registration-and-reset-events

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting#powershell-reporting-on-users-registered-for-mfa

Correct Answer: D

Get-MsolUser -All | Select-Object @{N='UserPrincipalName';E={$_.UserPrincipalName}}, @{N='MFA Status';E={if ($_.StrongAuthenticationRequirements.State){$_.StrongAuthenticationRequirements.State} else {"Disabled"}}}, @{N='MFA Methods';E={$_.StrongAuthenticationMethods.methodtype}} | Export-Csv -Path c:\MFA_Report.csv -NoTypeInformation