2.1.1. Planning Authentication and Tenant-Wide MFA Settings
💡 First Principle: MFA enforcement and method management are separate levers. Which methods exist for a user lives in the authentication methods policy; when MFA is demanded should live in Conditional Access — and the exam rewards moving everything toward that separation.
Three enforcement mechanisms coexist in real tenants, and you must rank them. Security defaults — the free, all-or-nothing baseline (MFA registration for everyone, MFA for admins, legacy auth blocked) — right for small orgs without P1. Per-user MFA (legacy) — enabled/enforced flags per account, no conditions, no nuance; Microsoft's guidance and the exam's correct answers migrate away from it. Conditional Access — the P1+ answer: policy-driven MFA based on user, app, risk, location, and device.
Method management is converging too: the authentication methods policy in the Entra admin center is the single place to enable methods (Authenticator, FIDO2, SMS, TAP, certificate-based auth…) and scope them to groups. It replaces the legacy MFA and SSPR method settings; Microsoft provides a migration toggle, and "migrate to the authentication methods policy" is the modern-answer tell in questions mentioning legacy portals. Alongside sit tenant MFA hygiene items: account lockout thresholds, fraud alert/report suspicious activity, trusted IPs (legacy — prefer named locations), and number matching with additional context, now default for Authenticator push.
Planning heuristics the exam expects: register at least two methods per user (resilience), prefer Authenticator or passkeys over telecom methods, protect the registration moment itself (see registration campaigns, 2.3.2, and securing security info registration via Conditional Access), and never leave admins on SMS.
⚠️ Exam Trap: Security defaults and Conditional Access are mutually exclusive — you must disable security defaults before CA policies take effect. A stem where "CA policies aren't applying" in a new tenant is usually this switch.
Reflection Question: Why does Microsoft steer MFA enforcement into Conditional Access but MFA method enablement into a tenant-wide policy — what different questions do the two answer?