Exam MS-100 topic 4 question 69 discussion

HOTSPOT -
You have a Microsoft 365 E5 subscription that contains the users shown in the following table.

You configure a multi-factor authentication (MFA) registration policy that has the following settings:
Assignments:

- Include: Group1
- Exclude: Group2
✑ Access controls: Require Azure MFA registration
✑ Enforce Policy: On
You create a conditional access policy that has the following settings:
✑ Name: Policy1
✑ Assignments:
- Include: Group2
- Exclude: Group1
✑ Access controls:
- Grant, Require multi-factor authentication
✑ Enable policy: On
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Suggested Answer:
Box 1: No -
The MFA policy applies to User1 so he will be prompted to register for MFA. He has 14 days to complete the registration. During this 14-day period, he can bypass registration but at the end of the period he will be required to register before he can complete the sign-in process.
The Conditional Access Policy does not apply to User1 so MFA is not required.

Box 2: No -
User2's MFA status is Enabled which means he has been enrolled in MFA but has not yet completed the registration.
The Conditional Access Policy does not apply to User2 because Group1 is excluded so MFA is not required.

Box 3: Yes -
The Conditional Access Policy does apply to User3 so MFA will be required. He will need to be enrolled for MFA first.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-mfa-policy https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/set-up-multi-factor-authentication?view=o365-worldwide