Question

Your organization has deployed FIDO2 security keys and Microsoft Authenticator passwordless sign-in to all administrators. Security policy now requires that members of the Global Administrator and Security Administrator roles can only complete sign-in using phishing-resistant methods, while all other users may continue to satisfy MFA with any registered method. You need to enforce this using Conditional Access with the least administrative effort. What should you configure?

Accepted Answer

Create a Conditional Access policy targeting the privileged roles that requires the built-in 'Phishing-resistant MFA' authentication strength as a grant control.

Answer

Create a Conditional Access policy targeting the privileged roles that requires 'Require multifactor authentication' as the grant control.

Answer

Disable password and SMS authentication methods for the entire tenant in the Authentication methods policy.

Answer

Create a Conditional Access policy that requires a compliant device for the privileged roles.