Question

A financial services company must comply with a regulation that mandates phishing-resistant multifactor authentication for all administrators. The security architect wants to standardize on Entra ID Conditional Access to enforce this requirement, while also allowing a small partner group to authenticate using the partner's own certified FIDO2 solution that Entra ID does not natively provide. The design must ensure that only phishing-resistant methods satisfy MFA for privileged operations. Which combination of capabilities should the architect include in the design?

Accepted Answer

Create a Conditional Access authentication strength policy requiring phishing-resistant MFA, and configure external authentication methods (EAM) to integrate the partner's FIDO2 provider.

Answer

Enable the legacy MFA per-user settings for administrators and register the partner's FIDO2 keys as trusted devices in Intune.

Answer

Create a Conditional Access policy requiring 'Multifactor authentication' as the grant control and allow SMS and Microsoft Authenticator push as acceptable methods.

Answer

Configure a named location for the partner and exempt them from MFA, while enforcing number matching in the Authenticator app for internal administrators.