2.1. Microsoft Entra User Authentication

💡 First Principle: Authentication design is portfolio management for proof. Each method trades off strength, usability, and deployability, so your job is to move the population up the ladder — password+SMS at the bottom, passwordless phishing-resistant at the top — while keeping recovery paths that don't become backdoors.

Why this matters beyond points: compromised credentials are the front door of nearly every identity breach, and Microsoft's telemetry consistently shows MFA blocking the overwhelming majority of automated attacks. The exam mirrors reality here — expect stems asking for the strongest method that satisfies a constraint, or the migration path off legacy per-user MFA.

Your mental model for the whole section is a strength ladder with a management plane beside it: the authentication methods policy (who may register/use which methods) governs the ladder, while authentication strengths (2.2) let Conditional Access demand a minimum rung for sensitive access.

⚠️ Common Misconception: "Any MFA is equivalent." SMS and voice are phishable and SIM-swappable; Authenticator push resists SIM-swap but falls to fatigue attacks (mitigated by number matching); only FIDO2 passkeys, Windows Hello for Business, and certificate-based authentication are phishing-resistant. Scenarios that say "protect against phishing" have already eliminated everything below the top rung.